dhcpcd-discuss

Raw and Raw6 sockets bound to port 17?

Murray

Sun Aug 16 03:42:01 2020

Hello,

Please pardon me if this issue is covered elsewhere, but I've been unable
to find information regarding it.  Recently I noticed that on my local
Linux desktop, dhcpcd is binding raw sockets to both IPv4 and IPv6 port 17,
and appears to never (or very rarely) check what it receives on that port
(my basis for this statement is that the RECV QUEUE, as shown by `netstat`,
is enormous).

I checked the local configuration files and didn't see anything odd, nor
did I notice anything in the systemd unit files that would explain the
behavior.  Google also wasn't of much help, and port 17 appears to be a
throwback to the quote of the day on UNIX systems.  The DHCP server on my
local network is a standard ISP provided wireless router, but as the
customer, I certainly don't have access to any configuration options that
would cause this.

My interest here is primarily understanding why I haven't always seen this
behavior, and what specifically is causing the program to use raw sockets
and bind to a mysterious port (whether specific to dhcpcd or the DHCP
protocol itself).  I took a snapshot of the system memory, and the output
of Volatility's "netstat" command is shown below (`netstat` on a live
system showed raw sockets).  Can anybody explain what I'm seeing, or
perhaps point me in the direction of documentation that can?


UDP      0.0.0.0         :    0 0.0.0.0         :    0
>        dhcpcd/599
> UDP      0.0.0.0         :   17 0.0.0.0         :    0
>        dhcpcd/600
> UNIX 21919               dhcpcd/600
> UDP      ::              :   17 ::              :    0
>        dhcpcd/600
> UNIX 14249               dhcpcd/600
> UNIX 20322               dhcpcd/600
> UNIX 14251               dhcpcd/600
> UDP      0.0.0.0         :   68 0.0.0.0         :    0
>        dhcpcd/601
> UNIX 21919               dhcpcd/601
> UDP      ::              :  546 ::              :    0
>        dhcpcd/601
> UDP      0.0.0.0         :   17 0.0.0.0         :    0
>        dhcpcd/683
> UNIX 21919               dhcpcd/683
> UDP      ::              :   17 ::              :    0
>        dhcpcd/683
>

Thank you for your time,
Murray Miron

Follow-Ups:
Re: Raw and Raw6 sockets bound to port 17?Roy Marples
Archive administrator: postmaster@marples.name