Re: wierdness in my security report

From: Duncan Patton a Campbell is Dhu (campbell@neotext.ca)
Date: 07/30/02 

From: "Duncan Patton a Campbell is Dhu" <campbell@neotext.ca>
To: "Craig Miller" <craig@millerfam.net>, "Duncan Patton a Campbell is Dhu" <campbell@neotext.ca>, "faSty" <fasty@i-sphere.com>
Date: Mon, 29 Jul 2002 17:53:12 -0600

Hmm. I saw this *** when I was running a telus adsl link, and
the logs
for it are long gone. If you can give a better description of
your layout
it might kick over some of my neurons... I think you are
running something
like:

ATT <DSL> BSDGATE <ETHER> InternalBox
                                InternalBox
                                .
                                .
                                etc

the .1 address is the ATT default router

Duncan Patton a Campbell is Duibh ;-)

---------- Original Message -----------
From: "Craig Miller" <craig@millerfam.net>
To: "Duncan Patton a Campbell is Dhu" <campbell@neotext.ca>,
"faSty" <fasty@i-sphere.com>
Sent: Sun, 28 Jul 2002 13:23:47 -0700
Subject: Re: wierdness in my security report

> That is correct, they are not my MAC addresses. Also,
> based on the mac address it is Cisco hardware further
> pointing toward AT&Ts hardware since my FreeBSD box
> definately is not made by Cisco.
>
> --Craig
>
> ----- Original Message -----
> From: "Duncan Patton a Campbell is Dhu" <campbell@neotext.ca>
> To: "faSty" <fasty@i-sphere.com>; "Craig Miller"
<craig@millerfam.net>
> Cc: <freebsd-security@FreeBSD.ORG>
> Sent: Thursday, July 18, 2002 1:48 PM
> Subject: Re: wierdness in my security report
>
> > This I've seen too, but he sez the mac's aren't his....
> >
> > Duncan Patton a Campbell is Duibh ;-)
> >
> > ---------- Original Message -----------
> > From: faSty <fasty@i-sphere.com>
> > To: Craig Miller <craig@millerfam.net>
> > Sent: Thu, 18 Jul 2002 13:42:03 -0700
> > Subject: Re: wierdness in my security report
> >
> > > DO you have bridge on your server?
> > >
> > > I have that same similar and the bridge 2 ethernet
> > > port fight over who master the primary IP address.
> > >
> > > -fasty
> > >
> > > On Thu, Jul 18, 2002 at 10:47:21AM -0700, Craig Miller
> > > wrote:
> > > > Anyone have any ideas as to what might be causing the
> > following to appear in my security report?
> > > >
> > > > arp: 12.236.220.1 moved from 00:b0:64:b7:6f:54 to
> > 00:b0:64:b7:6f:a8 on dc0
> > > > > Jul 17 05:47:56 server /kernel: arp: 12.236.220.1
moved
> > from 00:b0:64:b7:6f:54 to 00:b0:64:b7:6f:a8 on dc0
> > > > > arp: 12.236.220.1 moved from 00:b0:64:b7:6f:a8 to
> > 00:b0:64:b7:6f:54 on dc0
> > > > > Jul 17 05:47:57 server /kernel: arp: 12.236.220.1
moved
> > from 00:b0:64:b7:6f:a8 to 00:b0:64:b7:6f:54 on dc0
> > > >
> > > > I thought those : delimited fields would be MAC
addresses,
> > but they don't match the MAC addresses of either of the two
> > cards in my free-bsd box. I have not checked the MAC
addresses
> > of the other network cards on my network.
> > > >
> > > > Also, where does the "server /kernel" name come from.
> > "kernel" is not the name I gave my kernel, so I am
suspicious.
> > > >
> > > > Thanks,
> > > >
> > > > --Craig
> > > >
> > >
> > > To Unsubscribe: send mail to majordomo@FreeBSD.org
> > > with "unsubscribe freebsd-security" in the body of the
> > > message
> > ------- End of Original Message -------
> >
> >
> > To Unsubscribe: send mail to majordomo@FreeBSD.org
> > with "unsubscribe freebsd-security" in the body of the
message
------- End of Original Message -------

To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-security" in the body of the message

Quantcast