Re: Kernel log message

From: Peter C. Lai (sirmoo@cowbert.2y.net)
Date: 10/13/02 

Date: Sun, 13 Oct 2002 00:17:40 -0400
From: "Peter C. Lai" <sirmoo@cowbert.2y.net>
To: William Wallace <ww@austin.rr.com>

This looks like another candidate for an entry in the FAQ, since
in the past 3 years that I have been on this list, questions about the
arp messages have been asked and answered many many times.

Take the message at face value.
All it is saying is at Oct 5 08:03:57, the kernel detected that
192.168.100.2 broadcasted its MAC address as something different than
what it had been broadcasting before.

This could mean that 192.168.100.2 changed its MAC address, or
that some other device decided to become 192.168.100.2

There are many causes of that happening; if I create an IP conflict
with 2 devices having 192.168.100.2 and both keep broadcasting,
that would cause the the MAC to alternate every time i talk to 192.168.100.1.

On Sat, Oct 12, 2002 at 07:37:33PM -0500, William Wallace wrote:
>
> > Could someone explain to me what the following log message means:
> >
> > disco.wwallace.net kernel log messages:
> > > arp: 192.168.100.2 moved from 00:20:78:0d:5a:7f to 00:00:78:0d:5a:7f on
> > de0
> > > Oct 5 08:03:57 disco /kernel: arp: 192.168.100.2 moved from
> > 00:20:78:0d:5a:7f to 00:00:78:0d:5a:7f on de0
> >
> > The machine in question (192.168.100.2) is a Windows 2000 machine that has
> > had the same NIC for years. Also, only one of the digits in the MAC
> > address seems to have changed. What could cause this?
> >
> > Thanks,
> > - William.
> >
> > 

-- 
Peter C. Lai
University of Connecticut
Dept. of Molecular and Cell Biology
Yale University School of Medicine
Center for Medical Informatics | Research Assistant
http://cowbert.2y.net/
To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-security" in the body of the message

Relevant Pages

  • Re: Rouge APs at Work - How to locate them?!
    ... and from a rogue access point on the LAN. ... We know the MAC address of _everything_ that is connected to our net. ... Therefore, anything that is broadcasting these packets, but is not ... It had better accept it or the rouge access point could not be used to ...
    (alt.internet.wireless)
  • Re: Newbie security question
    ... Leythos wrote: ... >> connect to 'my' MAC), I am sufficiently protected on the wireless side. ... > 128 bit, a MAC filter that you are safe, BUT since you are broadcasting ... > broadcasting of the SSID. ...
    (comp.security.firewalls)
  • Re: What is my MAC address?
    ... >> I already know how to find my MAC address and IP address by locally ... >> IP address I am broadcasting. ... >replaced by the mac address of the router. ... NetBIOS session to a remote computer, ...
    (comp.os.linux.networking)
  • Re: What is my MAC address?
    ... >> I already know how to find my MAC address and IP address by locally ... >> IP address I am broadcasting. ... >replaced by the mac address of the router. ... NetBIOS session to a remote computer, ...
    (comp.security.firewalls)
  • Kernel log message
    ... > disco.wwallace.net kernel log messages: ... > The machine in question is a Windows 2000 machine that has ... only one of the digits in the MAC ... with "unsubscribe freebsd-security" in the body of the message ...
    (FreeBSD-Security)