[Shorewall-users] Neighbour table overflow

Tom Eastep
Mon, 28 Oct 2002 00:20:21 -0000

Adam Henry wrote:

> |
> | Oct 25 11:30:36 fw kernel: Shorewall:rfc1918:DROP:IN=Serial0
> | OUT= MAC= SRC=10.3.32.1 DST=aaa.aaa.aaa.aaa LEN=56 TOS=0x00 PREC=0x00
> | TTL=241 ID=45499 PROTO=ICMP TYPE=3 CODE=1 [SRC=aaa.aaa.aaa.aaa
> | DST=68.97.0.94 LEN=84 TOS=0x00 PREC=0x00 TTL=52 ID=0 DF PROTO=ICMP
> | TYPE=8 CODE=0 ID=11895 SEQ=0 ]
>
> These have been occurring more frequently, and I''m interpreting
them
> as this:  An interface somewhere on the Internet reporting to be
> 10.3.32.1 is contacting aaa.aaa.aaa.aaa (the firewall) and saying that
> the destination host is unreachable.  The datagram of the ICMP packet
> contains information about a ICMP echo which originated from the firewall
> (MASQ possibly?) and was destined for 68.97.0.94 out in the Internet.
> Is my view on the information the log presents me sound?
>
> The 10.3.32.1 and 68.97.0.94 change, which makes me think the user at
> this address is scanning networks and getting answers back saying the
> hosts are unreachable.  This makes me believe that this host on the LAN
> has been compromised (un/knowingly).

I refuse to spend any time on an ICMP problem with the IP addresses
falsified; they are tricky enough when you have all of the information.
You might find my recent response in a thread entitled "Rejected ICMP
packets" helpful.

>
> These may be separate issues, but I thought I would also mention the
> "kernel: Neighbour table overflow." error I get quite frequently.
> The research I have done suggests that the lo interface is not enabled.
> Here are some more details about this machine:
>
> | # ip nei
> | 10.10.10.14 dev eth0 lladdr 00:40:f4:2e:78:ef nud reachable
> | 10.10.10.39 dev eth0 lladdr 00:10:a4:11:38:2d nud reachable
> | 10.10.10.250 dev eth0 lladdr 00:04:c1:66:30:c0 nud stale
> | 10.10.10.251 dev eth0 lladdr 00:06:28:01:bc:80 nud reachable
> | 10.10.10.34 dev eth0 lladdr 00:10:a4:98:51:2c nud reachable
> | 10.10.10.196 dev eth0 lladdr 00:10:a4:7b:49:74 nud reachable
> | 10.10.10.19 dev eth0 lladdr 00:40:f4:1f:93:f5 nud reachable
>
> | # ifconfig lo
> | lo        Link encap:Local Loopback
> |           inet addr:127.0.0.1  Mask:255.0.0.0
> |           UP LOOPBACK RUNNING  MTU:16436  Metric:1
> |           RX packets:31 errors:0 dropped:0 overruns:0 frame:0
> |           TX packets:31 errors:0 dropped:0 overruns:0 carrier:0
> |           collisions:0 txqueuelen:0
> |           RX bytes:2324 (2.2 KiB)  TX bytes:2324 (2.2 KiB)
>
> | # free
> |              total       used       free     shared    buffers
> | cached
> | Mem:         62772      57068       5704          0       7324
> | 15120
> | -/+ buffers/cache:      34624      28148
> | Swap:       128516       1600     126916
>
> How likely is it that I need more system memory to have an ARP table
> larger than 7 entries?
>

I''ve never seen this problem personally (although I see it reported
quite
a bit on other lists) and I don''t recall anything about it.

Sorry,
-Tom
--
Tom Eastep    \ Shorewall - iptables made easy
AIM: tmeastep  \ http://www.shorewall.net
ICQ: #60745924  \ teastep@shorewall.net