From owner-freebsd-questions Sun Apr 23 15:49:50 2000 Delivered-To: freebsd-questions@freebsd.org Received: from cc942873-a.ewndsr1.nj.home.com (cc942873-a.ewndsr1.nj.home.com [24.2.89.207]) by hub.freebsd.org (Postfix) with ESMTP id 9836337B866 for ; Sun, 23 Apr 2000 15:49:45 -0700 (PDT) (envelope-from cjc@cc942873-a.ewndsr1.nj.home.com) Received: (from cjc@localhost) by cc942873-a.ewndsr1.nj.home.com (8.9.3/8.9.3) id SAA71818; Sun, 23 Apr 2000 18:49:05 -0400 (EDT) (envelope-from cjc) Date: Sun, 23 Apr 2000 18:49:05 -0400 From: "Crist J. Clark" To: Dan Larsson Cc: "'miy'" , freebsd-questions@FreeBSD.ORG Subject: Re: network replies causing system messages flooding Message-ID: <20000423184904.F70371@cc942873-a.ewndsr1.nj.home.com> Reply-To: cjclark@home.com References: <000801bfad5b$dea8d920$1401a8c0@intranet.tyfon.net> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii X-Mailer: Mutt 1.0i In-Reply-To: <000801bfad5b$dea8d920$1401a8c0@intranet.tyfon.net>; from dl@tyfon.net on Sun, Apr 23, 2000 at 09:41:07PM +0200 Sender: owner-freebsd-questions@FreeBSD.ORG Precedence: bulk X-Loop: FreeBSD.ORG On Sun, Apr 23, 2000 at 09:41:07PM +0200, Dan Larsson wrote: > | -----Original Message----- > | From: owner-freebsd-questions@FreeBSD.ORG > | [mailto:owner-freebsd-questions@FreeBSD.ORG]On Behalf Of miy > | Sent: Sunday, April 23, 2000 9:18 PM > | To: cjclark@home.com > | Cc: freebsd-questions@FreeBSD.ORG > | Subject: Re: network replies causing system messages flooding > | > | > | > | My system messages are still being flooded by the following message: > | > | arp: 10.0.0.4 is on ed1 but got reply from 00:80:c8:e8:ea:d7 on rl0 > | arp: 10.0.0.4 is on ed1 but got reply from 00:80:c8:e8:ea:d7 on rl0 > | > | while I try and solve this problem, is there any way I can filter > | them from system logging? > > The options you're looking for are in /etc/syslog.conf. Check line > which ends with /dev/console. > > For further info: man syslog.conf The problem with trying to stop these at syslogd(8) is that these are kernel messages being generated at the LOG_ERR level. I really would not want to toss them out at the expense of losing other messages at that level. Now, you can run the syslogd output through some type of filtering program, but that would be a whole other problem with plenty of gotchas of its own. The code that generates these messages is in /usr/src/sys/netinet/if_ether.c, if (rt->rt_ifp != &ac->ac_if) { log(LOG_ERR, "arp: %s is on %s%d but got reply from %6D on %s%d\n", inet_ntoa(isaddr), rt->rt_ifp->if_name, rt->rt_ifp->if_unit, ea->arp_sha, ":", ac->ac_if.if_name, ac->ac_if.if_unit); goto reply; } Now, before anyone uses this patch: I AM NOT A KERNEL HACKER. I DO NOT KNOW WHAT THE HELL I AM DOING. But the following patch should turn off those messages if you set, option ARP_IGNORE_WRONG_IF In your kernel configuration file. --- if_ether.c Fri Oct 22 04:02:33 1999 +++ if_ether.c Sun Apr 23 18:45:17 2000 @@ -539,11 +539,13 @@ if (la && (rt = la->la_rt) && (sdl = SDL(rt->rt_gateway))) { #ifndef BRIDGE /* the following is not an error when doing bridging */ if (rt->rt_ifp != &ac->ac_if) { +#ifndef ARP_IGNORE_WRONG_IF /* do not log the packet -- NOT RECOMMENDED */ log(LOG_ERR, "arp: %s is on %s%d but got reply from %6D on %s%d\n", inet_ntoa(isaddr), rt->rt_ifp->if_name, rt->rt_ifp->if_unit, ea->arp_sha, ":", ac->ac_if.if_name, ac->ac_if.if_unit); +#endif goto reply; } #endif -- Crist J. Clark cjclark@home.com To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-questions" in the body of the message