| View previous topic :: View next topic |
| Author |
Message |
kahcepb
n00b
Joined: 08 Apr 2003
Posts: 34
|
 Posted: Tue Aug 05, 2003 4:14 pm Post subject: Arp problem or something else? |
 |
|
| Code: | | Aug 03 06:17:52 ll-art /kernel: arp: 00:00:00:00:00:00 attempts to modify permanent entry for 192.168.1.60 on fxp0 |
| Code: | | Aug 03 11:07:02 ll-art /kernel: arp: 00:00:00:00:00:00 attempts to modify permanent entry for 192.168.1.140 on fxp0 |
these are syslog messages from ll-art -- our company's FreeBSD-4.7-based router/NAT/dhcp server box.
192.168.1.60 and 192.168.1.140 both are Gentoo (~x86/gentoo-sources-2.4.20-r5/ip assigned by dhcp) workstations. such messages appear some (well...1-10...randomly...) times per day.
any ideas?  |
|
| Back to top |
|
 |
devon
l33t
Joined: 23 Jun 2003
Posts: 943
|
| Posted: Wed Aug 06, 2003 4:53 am Post subject: |
|
|
| I see those on my FreeBSD box acting as a firewall/gateway to my cable modem. I just ignore them. I guess it is when the arp times out and the FreeBSD kernel refreshes its ARP table. |
|
| Back to top |
|
|
kahcepb
n00b
Joined: 08 Apr 2003
Posts: 34
|
| Posted: Wed Aug 06, 2003 5:11 am Post subject: |
|
|
i think it's a arp cache expiration too...maybe...damn...not sure...is there a way to find out it for certain?  |
|
| Back to top |
|
|
kahcepb
n00b
Joined: 08 Apr 2003
Posts: 34
|
| Posted: Sat Aug 09, 2003 5:03 am Post subject: |
|
|
ghosts 
| Quote: | From: Arpwatch <arpwatch@ADMINS.cm2.ru>
To: root@ADMINS.cm2.ru
Subject: changed ethernet address
Date: Wed, 6 Aug 2003 17:47:57 +0400
hostname: <unknown>
ip address: 192.168.1.140
ethernet address: 0:10:4b:9e:94:34
ethernet vendor: <unknown>
old ethernet address: 0:3:47:ac:28:f1
old ethernet vendor: <unknown>
timestamp: Wednesday, August 6, 2003 17:47:57 +0400
previous timestamp: Wednesday, August 6, 2003 17:47:57 +0400
delta: 0 seconds |
there's only 1 real user on .140 (system build not complete yet so only root account exist). wtf? |
|
| Back to top |
|
|
|
Networking & Security
