Those are DHCP request from client computers to the broadcast address
255.255.255.255, that type of requests are used when the client computer has no valid DHCP leases in its lease database. Block them but don't log or react to them in any way, they are perfectly normal.
Edit: Actually that traffic has port numbers reversed, the usual initial DHCP request as seen from the DHCP server is like this:
Code:
2012-06-02 20:13:12.834373 rule 25..16777216/0(match): pass in on re0: 0.0.0.0.68 > 255.255.255.255.67: BOOTP/DHCP, Request [|bootp]
I'm not sure if what you're seeing is malicious but I'd say you can still block it and forget it.
Where does your
<bruteforce> table come from and what does it contain?
Edit2: I think the traffic is actually replies to various DHCP clients from a DHCP server on your WAN (axe0 is you WAN connection?), the DHCP server sends the reply to the client requesting a lease using the broadcast address
255.255.255.255 because the client does not have an IP address in the first place.
Here's my
pf(4) rules for allowing DHCP in and out on my WAN connection so that I can get a lease from my ISP's DHCP server. I don't think you go any stricter on these rules because DHCP doesn't play well with stateful filtering.
Code:
# Allow DHCP on WAN
pass in log quick on $WAN inet proto udp from any port = bootps to any port = bootpc
pass out log quick on $WAN inet proto udp from any port = bootpc to any port = bootps
