hi all, i got flooded by these msgs like 1000+ lines, any idea? my kernel is dated Nov-30 FreeBSD 4.9-stable # tail -f /var/log/messages Jan 18 19:43:23 xb /kernel: arp: 202.79.180.1 moved from 00:04:5a:49:eb:74 to 00:50:0f:4f:c0:00 on rl0 Jan 18 19:45:06 xb /kernel: arp: 202.79.180.1 moved from 00:50:0f:4f:c0:00 to 00:04:5a:49:eb:74 on rl0 Jan 18 19:45:18 xb /kernel: arp: 202.79.180.1 moved from 00:04:5a:49:eb:74 to 00:50:0f:4f:c0:00 on rl0 Jan 18 19:45:41 xb /kernel: arp: 202.79.180.1 moved from 00:50:0f:4f:c0:00 to 00:04:5a:49:eb:74 on rl0 Jan 18 19:45:45 xb /kernel: arp: 202.79.180.1 moved from 00:04:5a:49:eb:74 to 00:50:0f:4f:c0:00 on rl0 thanks and regards, John
Hi, you might want to check that you dont have a two machines/devices in your network sharing the same IP-address. Of course there is a possibility of some one doing sniffing in your network. On Sun, 18 Jan 2004, Spades wrote:> hi all, i got flooded by these msgs like 1000+ lines, any idea? > my kernel is dated Nov-30 FreeBSD 4.9-stable > > # tail -f /var/log/messages > Jan 18 19:43:23 xb /kernel: arp: 202.79.180.1 moved from 00:04:5a:49:eb:74 > to 00:50:0f:4f:c0:00 on rl0 > Jan 18 19:45:06 xb /kernel: arp: 202.79.180.1 moved from 00:50:0f:4f:c0:00 > to 00:04:5a:49:eb:74 on rl0 > Jan 18 19:45:18 xb /kernel: arp: 202.79.180.1 moved from 00:04:5a:49:eb:74 > to 00:50:0f:4f:c0:00 on rl0 > Jan 18 19:45:41 xb /kernel: arp: 202.79.180.1 moved from 00:50:0f:4f:c0:00 > to 00:04:5a:49:eb:74 on rl0 > Jan 18 19:45:45 xb /kernel: arp: 202.79.180.1 moved from 00:04:5a:49:eb:74 > to 00:50:0f:4f:c0:00 on rl0 > > thanks and regards, > > John > > _______________________________________________ > freebsd-security@freebsd.org mailing list > http://lists.freebsd.org/mailman/listinfo/freebsd-security > To unsubscribe, send any mail to "freebsd-security-unsubscribe@freebsd.org" >
On Sun, Jan 18, 2004 at 08:14:29PM +0800, Spades wrote:> hi all, i got flooded by these msgs like 1000+ lines, any idea? > my kernel is dated Nov-30 FreeBSD 4.9-stable > > # tail -f /var/log/messages > Jan 18 19:43:23 xb /kernel: arp: 202.79.180.1 moved from 00:04:5a:49:eb:74 > to 00:50:0f:4f:c0:00 on rl0 > Jan 18 19:45:06 xb /kernel: arp: 202.79.180.1 moved from 00:50:0f:4f:c0:00 > to 00:04:5a:49:eb:74 on rl0 > Jan 18 19:45:18 xb /kernel: arp: 202.79.180.1 moved from 00:04:5a:49:eb:74 > to 00:50:0f:4f:c0:00 on rl0 > Jan 18 19:45:41 xb /kernel: arp: 202.79.180.1 moved from 00:50:0f:4f:c0:00 > to 00:04:5a:49:eb:74 on rl0 > Jan 18 19:45:45 xb /kernel: arp: 202.79.180.1 moved from 00:04:5a:49:eb:74 > to 00:50:0f:4f:c0:00 on rl0looks like someone is using tools like ettercap. airot
> > looks like someone is using tools like ettercap.It could either be that - ARP cache poisoning - or some sort of clustering software which uses changing MAC addresses (seen that).
On Sun, 18 Jan 2004 20:14:29 +0800 "Spades" <spades@galaxynet.org> wrote:> hi all, i got flooded by these msgs like 1000+ lines, any idea? > my kernel is dated Nov-30 FreeBSD 4.9-stable > > # tail -f /var/log/messages > Jan 18 19:43:23 xb /kernel: arp: 202.79.180.1 moved from 00:04:5a:49:eb:74 > to 00:50:0f:4f:c0:00 on rl0 > Jan 18 19:45:06 xb /kernel: arp: 202.79.180.1 moved from 00:50:0f:4f:c0:00 > to 00:04:5a:49:eb:74 on rl0 > Jan 18 19:45:18 xb /kernel: arp: 202.79.180.1 moved from 00:04:5a:49:eb:74 > to 00:50:0f:4f:c0:00 on rl0 > Jan 18 19:45:41 xb /kernel: arp: 202.79.180.1 moved from 00:50:0f:4f:c0:00 > to 00:04:5a:49:eb:74 on rl0 > Jan 18 19:45:45 xb /kernel: arp: 202.79.180.1 moved from 00:04:5a:49:eb:74 > to 00:50:0f:4f:c0:00 on rl0 > > thanks and regards, > > John > > _______________________________________________ > freebsd-questions@freebsd.org mailing list > http://lists.freebsd.org/mailman/listinfo/freebsd-questions > To unsubscribe, send any mail to "freebsd-questions-unsubscribe@freebsd.org" ># sysctl net.link.ether.inet.log_arp_wrong_iface=1 should mask the messages. horio shoichi
At 07:14 AM 01/18/04, you wrote:>hi all, i got flooded by these msgs like 1000+ lines, any idea? >my kernel is dated Nov-30 FreeBSD 4.9-stable > ># tail -f /var/log/messages >Jan 18 19:43:23 xb /kernel: arp: 202.79.180.1 moved from 00:04:5a:49:eb:74 >to 00:50:0f:4f:c0:00 on rl0 >Jan 18 19:45:06 xb /kernel: arp: 202.79.180.1 moved from 00:50:0f:4f:c0:00 >to 00:04:5a:49:eb:74 on rl0 >Jan 18 19:45:18 xb /kernel: arp: 202.79.180.1 moved from 00:04:5a:49:eb:74 >to 00:50:0f:4f:c0:00 on rl0 >Jan 18 19:45:41 xb /kernel: arp: 202.79.180.1 moved from 00:50:0f:4f:c0:00 >to 00:04:5a:49:eb:74 on rl0 >Jan 18 19:45:45 xb /kernel: arp: 202.79.180.1 moved from 00:04:5a:49:eb:74 >to 00:50:0f:4f:c0:00 on rlYou have a Linksys and Cisco device fighting over a IP address either they both think they own the address or one or maybe both are proxy arping for the address. The fields 00:04:5a:49:eb:74 & 00:50:0f:4f:c0:00 are the ethernet address of the Linksys and Cisco devices respectively. Regards, Lyle Evans evansl@rackears.com rackmount brackets for many networking and ISP equipment chassises http://www.rackears.com
But what causes them ? I get them too.> On Sun, 18 Jan 2004 20:14:29 +0800 > "Spades" <spades@galaxynet.org> wrote: > > hi all, i got flooded by these msgs like 1000+ lines, any idea? > > my kernel is dated Nov-30 FreeBSD 4.9-stable > > > > # tail -f /var/log/messages > > Jan 18 19:43:23 xb /kernel: arp: 202.79.180.1 moved from00:04:5a:49:eb:74> > to 00:50:0f:4f:c0:00 on rl0 > > Jan 18 19:45:06 xb /kernel: arp: 202.79.180.1 moved from00:50:0f:4f:c0:00> > to 00:04:5a:49:eb:74 on rl0 > > Jan 18 19:45:18 xb /kernel: arp: 202.79.180.1 moved from00:04:5a:49:eb:74> > to 00:50:0f:4f:c0:00 on rl0 > > Jan 18 19:45:41 xb /kernel: arp: 202.79.180.1 moved from00:50:0f:4f:c0:00> > to 00:04:5a:49:eb:74 on rl0 > > Jan 18 19:45:45 xb /kernel: arp: 202.79.180.1 moved from00:04:5a:49:eb:74> > to 00:50:0f:4f:c0:00 on rl0 > > > > thanks and regards, > > > > John > > > > _______________________________________________ > > freebsd-questions@freebsd.org mailing list > > http://lists.freebsd.org/mailman/listinfo/freebsd-questions > > To unsubscribe, send any mail to"freebsd-questions-unsubscribe@freebsd.org"> > > > # sysctl net.link.ether.inet.log_arp_wrong_iface=1 > > should mask the messages. > > > > horio shoichi > > _______________________________________________ > freebsd-questions@freebsd.org mailing list > http://lists.freebsd.org/mailman/listinfo/freebsd-questions > To unsubscribe, send any mail to"freebsd-questions-unsubscribe@freebsd.org">