From owner-freebsd-questions  Thu Aug  3 23:43:31 2000
Delivered-To: freebsd-questions@freebsd.org
Received: from mailhost01.reflexnet.net (mailhost01.reflexnet.net [64.6.192.82])
	by hub.freebsd.org (Postfix) with ESMTP id BD7D237B82A
	for <freebsd-questions@freebsd.org>; Thu,  3 Aug 2000 23:43:28 -0700 (PDT)
	(envelope-from cjc@184.215.6.64.reflexcom.com)
Received: from 184.215.6.64.reflexcom.com ([64.6.215.184]) by mailhost01.reflexnet.net  with Microsoft SMTPSVC(5.5.1877.197.19);
	 Thu, 3 Aug 2000 23:42:25 -0700
Received: (from cjc@localhost)
	by 184.215.6.64.reflexcom.com (8.9.3/8.9.3) id XAA17700;
	Thu, 3 Aug 2000 23:43:19 -0700 (PDT)
	(envelope-from cjc)
Date: Thu, 3 Aug 2000 23:43:18 -0700
From: "Crist J . Clark" <cjclark@reflexnet.net>
To: Pierre Chiu <pccb@yahoo.com>
Cc: freebsd-questions@FreeBSD.ORG
Subject: Re: Problem: arp: unknown hardware address format (0x0800
Message-ID: <20000803234318.D66052@184.215.6.64.reflexcom.com>
Reply-To: cjclark@alum.mit.edu
References: <59125816885.20000803223510@yahoo.com>
Mime-Version: 1.0
Content-Type: text/plain; charset=us-ascii
X-Mailer: Mutt 1.0i
In-Reply-To: <59125816885.20000803223510@yahoo.com>; from pccb@yahoo.com on Thu, Aug 03, 2000 at 10:35:10PM -0400
Sender: owner-freebsd-questions@FreeBSD.ORG
Precedence: bulk
X-Loop: FreeBSD.ORG

On Thu, Aug 03, 2000 at 10:35:10PM -0400, Pierre Chiu wrote:
> This log is from /var/log/messages
> 
> Aug  3 21:48:01 zeus /kernel: arp: unknown hardware address format (0x0800)
> Aug  3 21:48:33 zeus last message repeated 4 times
> Aug  3 21:50:39 zeus last message repeated 16 times
> Aug  3 22:00:46 zeus last message repeated 75 times
> Aug  3 22:09:03 zeus last message repeated 63 times
> Aug  3 22:09:16 zeus /kernel: arp: unknown hardware address format (0x0800)
> Aug  3 22:09:48 zeus last message repeated 4 times
> Aug  3 22:11:55 zeus last message repeated 16 times
> Aug  3 22:21:48 zeus last message repeated 75 times
> 
> I just upgrade my freebsd 3.5 to freebsd 4.1-release on my machine and
> keep on getting this error message.
> 
> I don't see this error message in my 3.5 version. It only happena
> after I upgraded. It is on a cable connection but I am
> not sure if there is anything to do with it.
> 
> 
> Question:
> #1. Where are these ARP coming from?

Probably over your coax cable connection. To make sure, try to capture
them,

  # tpcdump -enw arp.dump arp

And have a look. That will print info about the packets and also dump
them to the file 'arp.dump.' See if you can make any sense of or
return to the list if you have more questions.

> #2. Is there anything wrong with my setup?

Probably not if these are coming in from the outside. Try to verify
they are with the above results.

> #3. How do I disable it if there is no danger to security?

Not a lot you can do there without hacking kernel, raising the level
of message logged from the kernel, or running the messages through a
filter. If it's someone's machine spewing junk on to the network, you
can try your ISP... but good luck. 
-- 
Crist J. Clark                           cjclark@alum.mit.com


To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-questions" in the body of the message