Re: arp problem in /var/log/messages

From: Patrick Muldoon (doon_at_inoc.net)
Date: 01/18/04

  • Next message: Sam Leffler: "Re: HiFn / FAST_IPSEC question" 
    To: Maciej Cetler <airot@lazir.toya.net.pl>, Spades <spades@galaxynet.org>
Date: Sun, 18 Jan 2004 11:07:32 -0500

    On Sunday 18 January 2004 10:35 am, Maciej Cetler wrote:
    > On Sun, Jan 18, 2004 at 08:14:29PM +0800, Spades wrote:
    > > hi all, i got flooded by these msgs like 1000+ lines, any idea?
    > > my kernel is dated Nov-30 FreeBSD 4.9-stable
    > >
    > > # tail -f /var/log/messages
    > > Jan 18 19:43:23 xb /kernel: arp: 202.79.180.1 moved from
    > > 00:04:5a:49:eb:74 to 00:50:0f:4f:c0:00 on rl0
    > > Jan 18 19:45:06 xb /kernel: arp: 202.79.180.1 moved from
    > > 00:50:0f:4f:c0:00 to 00:04:5a:49:eb:74 on rl0
    > > Jan 18 19:45:18 xb /kernel: arp: 202.79.180.1 moved from
    > > 00:04:5a:49:eb:74 to 00:50:0f:4f:c0:00 on rl0
    > > Jan 18 19:45:41 xb /kernel: arp: 202.79.180.1 moved from
    > > 00:50:0f:4f:c0:00 to 00:04:5a:49:eb:74 on rl0
    > > Jan 18 19:45:45 xb /kernel: arp: 202.79.180.1 moved from
    > > 00:04:5a:49:eb:74 to 00:50:0f:4f:c0:00 on rl0
    >
    > looks like someone is using tools like ettercap.
    >
    > airot

    is .1 your gateway?

    00:50:0f is a Cisco Adaptor
    00:04:5a is a linksys Adaptor

    What type of network are you on? IE is this your network? or is a say a
    cablemodem network?

    check out http://www.dslreports.com/forum/remark,8225369~mode=flat, which is
    basically about this same issue and perhaps might shed some light on the
    problem.

    If they where both Cisco Nic's it could be HSRP?

    Hope that helps,
    -Patrick 

    -- 
Patrick Muldoon
Network/Software Engineer
INOC (http://www.inoc.net)
PGPKEY (http://www.inoc.net/~doon)
Key ID: 0x370D752C
micro$oft: "where do you want to go today?" 
linux: "where do you want to go tomorrow?" 
BSD: "are you guys coming, or what?"

  • Next message: Sam Leffler: "Re: HiFn / FAST_IPSEC question"

    Relevant Pages

    • Re: [SLE] connection redundancy
      ... which is the router just this side of the ... >>because it's own gateway is still up. ... You'll also need three network cards to put into this Linux box. ... your internal LAN can route packets to the Internet. ...
      (SuSE)
    • Re: Cant access secure Web pages
      ... and which need to be contacted via the Default Gateway. ... The Default Gateway being the software process that does the network ... Gateway (as set up by your ISP's DHCP packet to the router), ... me so I can send it directly (to the MAC address discovered by ARP). ...
      (uk.comp.sys.mac)
    • Re: Problem with Cable Moden & Router.
      ... gateway is the way in or out. ... a gateway leads to another network. ... Where two routes with different network masks overlap ...
      (comp.os.linux.misc)
    • RE: [SLE] Two network cards (dual-homed), two gateways? Desparatefor help
      ... > and server, and different for the clients on each of the two networks. ... network set the default gateway to the IP address of the network ... network, but SSH doesn't work. ...
      (SuSE)
    • Re: Dual NICs, Routing Problem
      ... There can only be one default gateway (unless you are using extra stuff as ... network that is NOT directly attached to one of your interfaces. ... >> Do all the hosts on 192.1.36.0 know that if they want to talk to any host on ... Here, the web server needs to know the IP of eth0 on the DataBase Server, ...
      (alt.os.linux.suse)