[lug] securing DHCP

[D. Stimits]

It looks like DHCP, as used by AT&T cable modems, might need both ports 
67 and 68, UDP and TCP, available. I am on the local network, and seeing 
  (prior to completed cable modem install, the modem is there, but not 
all parts of it have been activated by AT&T yet) DHCP broadcasts from 
source 0.0.0.0:68 to 255.255.255.255:67. This might just be a stupid 
windows-ism frmo the win2k machine that is sitting on the net, or it 
might be from the AT&T cable modem. Regardless of source, does anyone 
know if the AT&T cable or DSL modems allow blocking of all sources 
except perhaps one DHCP server address? Or am I going to have to leave 
it open in the firewall for source 0.0.0.0 and destination 
255.255.255.255? I had thought this would be something like a 
nameserver, where I could add a known DHCP server address, and not leave 
it open to 0.0.0.0 broadcasts. Then again, 0.0.0.0 is probably not 
routable, and it probably can be guaranteed to come from the cable modem 
service. Does anyone have any general advice on ports and firewalling 
under DHCP, when there will be different windows and different linux 
machines on the net?

D. Stimits, stimits AT idcomm.com