Hi all!
FreeBSD 6.2-release.
I'm having trouble with arp:
arp: unknown hardware address format (0x4500)
and
arp: unknown hardware address format (0x4242)
these messages fall on the console in a plenty.
I do tcpdump -exn "arp[0]=0x45 and arp[1]=0":
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on xl0, link-type EN10MB (Ethernet), capture size 68 bytes
15:12:23.308179 00:02:55:53:46:13 > ff:ff:ff:ff:ff:ff, ethertype ARP
(0x0806), length 60: truncated-arp
0x0000: 4500 0020 9f4e 4000 3f2f bfa1 c0a8 fc6b E....N@.?/.....k
0x0010: c0a8 5f02 2081 880b 0000 8000 0000 0023 .._............#
0x0020: 0000 0000 0000 0000 0000 2020 2020 ..............
0x0000: 4500 0020 9f4e 4000 3f2f bfa1 c0a8 fc6b
0x0010: c0a8 5f02 2081 880b 0000 8000 0000 0023
0x0020: 0000 0000 0000 0000 0000 2020 2020
15:12:23.428057 00:02:55:53:46:13 > ff:ff:ff:ff:ff:ff, ethertype ARP
(0x0806), length 60: truncated-arp
0x0000: 4500 0020 9f4f 4000 3f2f bfa0 c0a8 fc6b E....O@.?/.....k
0x0010: c0a8 5f02 2081 880b 0000 8000 0000 0025 .._............%
0x0020: 0000 0000 0000 0000 0000 2020 2020 ..............
0x0000: 4500 0020 9f4f 4000 3f2f bfa0 c0a8 fc6b
0x0010: c0a8 5f02 2081 880b 0000 8000 0000 0025
0x0020: 0000 0000 0000 0000 0000 2020 2020
In the arp-table of my network there is not MAC-address 00:02:55:53:46:13.
Where is it address from?
How does it influence on safety?
How to solve this problem? Thanks
On Jan 24, 2007, at 4:32 AM, Ilia Gorstkin wrote:> I'm having trouble with arp: > arp: unknown hardware address format (0x4500) > and > arp: unknown hardware address format (0x4242) > these messages fall on the console in a plenty. > > I do tcpdump -exn "arp[0]=0x45 and arp[1]=0": > > tcpdump: verbose output suppressed, use -v or -vv for full protocol > decode > listening on xl0, link-type EN10MB (Ethernet), capture size 68 bytesPlease run "tcpdump -exxn -s 0 arp" to show the full packets including link-layer headers. You should be seeing a byte sequence more like: 0001 0800 0604 0001 ...followed by the sender's MAC address. This is from /usr/include/net/if_arp.h and means: ARPHRD_ETHER, ETHERTYPE_IP, hln=6, pln=4, ARPOP_REQUEST I don't know what 0x4500 means, but 0x4242 is: #define ETHERTYPE_PCS 0x4242 /* PCS Basic Block Protocol */ It seems more likely that you've got a hardware problem like a wacked out NIC or switch, or some really odd software bug... -- -Chuck
On 24/01/07, Ilia Gorstkin <cadavo@mail.ru> wrote:> Hi all! > > FreeBSD 6.2-release. > I'm having trouble with arp: > arp: unknown hardware address format (0x4500) > and > arp: unknown hardware address format (0x4242) > these messages fall on the console in a plenty.What kind of device is this? Is it a Linux server? I get the 0x4500 packets all the time from my Linux servers. Adrian -- Adrian Chadd - adrian@freebsd.org