Skip site navigation (1)Skip section navigation (2) 
Date:      Wed, 14 May 2008 18:32:21 -0400
From:      Jon Radel <jon@radel.com>
To:        Christer Solskogen <solskogen@carebears.mine.nu>,  freebsd questions <freebsd-questions@freebsd.org>
Subject:   Re: arplookup 0.0.0.0 failed: host is not on local network
Message-ID:  <482B6875.6070005@radel.com>
In-Reply-To: <g0fms3$8qs$1@ger.gmane.org>
References:  <g07lip$736$1@ger.gmane.org>	<6.0.0.22.2.20080511190114.0264af00@mail.computinginnovations.com>	<g09t4u$ads$1@ger.gmane.org>	<g0a0aa$lip$1@ger.gmane.org>	<6.0.0.22.2.20080512153543.02665c88@mail.computinginnovations.com>	<g0aa89$q0p$1@ger.gmane.org>	<6.0.0.22.2.20080512163401.026387f8@mail.computinginnovations.com>	<g0ei1m$r0a$1@ger.gmane.org>	<6.0.0.22.2.20080514131710.025269f0@mail.computinginnovations.com> <g0fms3$8qs$1@ger.gmane.org>
next in thread | previous in thread | raw e-mail | index | archive | help 

[-- Attachment #1 --]
Christer Solskogen wrote:
> 
> Derek Ragona wrote:
> 
>> I would do a traceroute from all your hosts there.  When you do keep 
>> an eye out for the arp error message.  This should help find the host 
>> causing these errors and then look at that systems configuration.
>>
>> Also do you have more than one ethernet interface in the system 
>> showing the arp errors?  If you do, make sure the interfaces are on 
>> different subnets.
>>
>>
> 
> traceroute dont show anything(no response). Only ping responds, and ping 
> respodns with "192.168.0.1" - which is my router. My router on the other 
> hand do not have this arp problem. Only the other machines.
> 
> Every machine, except my router, have only one interface. (my router has 
> two, butthey are on to different subnets)
> 

OK, this problem amused me enough to play around.  Unfortunately, while 
I was able to, somehow, replicate the log entries on a FreeBSD 6.2 box, 
I don't know how, as it was a box that I wasn't using for my experiments 
(though on the same LAN segment as those I was using) and it was only 
the next day that I realized that it had taken offense at something I'd 
done.  By then I'd forgotten what I'd tried in which order....

In any case, what I can tell you:

On FreeBSD (various versions from 4.9 to 7.0) and MacOS X 10.4, ping 
0.0.0.0 appears to be the equivalent of pinging the ipv4 default gateway 
(if you use tcpdump you can actually see the packets with a destination 
address of 0.0.0.0 go out and the replies come in).  OpenBSD 4.2 and 
Windows XP basically tell you can't do such a foolish thing.  I think 
this is a red herring.

I doubt you have an interface with a 0.0.0.0 address.  What I suspect 
you have is some software, somewhere on the same segment as the machine 
logging the complaints, that is triggering an ARP query for 0.0.0.0.

If you really want to track this down, what I'd strongly urge you to 
start with is to, on a machine where the log entries happen, run the command

tcpdump -vvv -n -l -e arp

and see if you can catch ARP traffic mentioning 0.0.0.0.  If you catch 
one, this will give you the MAC address of the source of the traffic.  I 
would hope that this would help narrow it down.

Meanwhile, I'll see if I can replicate this when I'm paying a bit more 
attention.  :-)

--Jon Radel

[-- Attachment #2 --]
0	*H
010	+0	*H
	100\mtv0
	*H
0b10	UZA1%0#U
Thawte Consulting (Pty) Ltd.1,0*U#Thawte Personal Freemail Issuing CA0
080324165921Z
090324165921Z0^10URadel10U*
Jon Thomas10UJon Thomas Radel10	*H
	
jon@radel.com0"0
	*H
0
t,Pp#
٬q_2=L-^m>z3ʟV![([ AoE}ϛ3/6?񥃮cWx(/)'$6sTl<*i'=uoxMbt
rdtnxud1R6T>zU0FZ,vN9NP{>qE`^P;	*Wg/jN*OVՠQMB(=:
*0(0U0
jon@radel.com0U00
	*H
h!oܨ[А!fN#[Z
b$3?x&$~Ħ9}`MX[It}/bXZajgxɥ' 2NrtWAr sFި'^@mDVw\)00\mtv0
	*H
0b10	UZA1%0#U
Thawte Consulting (Pty) Ltd.1,0*U#Thawte Personal Freemail Issuing CA0
080324165921Z
090324165921Z0^10URadel10U*
Jon Thomas10UJon Thomas Radel10	*H
	
jon@radel.com0"0
	*H
0
t,Pp#
٬q_2=L-^m>z3ʟV![([ AoE}ϛ3/6?񥃮cWx(/)'$6sTl<*i'=uoxMbt
rdtnxud1R6T>zU0FZ,vN9NP{>qE`^P;	*Wg/jN*OVՠQMB(=:
*0(0U0
jon@radel.com0U00
	*H
h!oܨ[А!fN#[Z
b$3?x&$~Ħ9}`MX[It}/bXZajgxɥ' 2NrtWAr sFި'^@mDVw\)0?0
0
	*H
010	UZA10UWestern Cape10U	Cape Town10U
Thawte Consulting1(0&UCertification Services Division1$0"UThawte Personal Freemail CA1+0)	*H
	personal-freemail@thawte.com0
030717000000Z
130716235959Z0b10	UZA1%0#U
Thawte Consulting (Pty) Ltd.1,0*U#Thawte Personal Freemail Issuing CA00
	*H
0Ħ<UsUNʙZhup[v:aQP
0cZ,p+Z?qV˯<6$*+w=+>@dקe*TH<a@dr`00U00CU<0:08642http://crl.thawte.com/ThawtePersonalFreemailCA.crl0U0)U"0 010UPrivateLabel2-1380
	*H
HP.
fgCL!6-6/P p<ab:~t%Pb'qW%ݩ9 Oe_N4[5MwV!x!5$F]_eO1d0`0v0b10	UZA1%0#U
Thawte Consulting (Pty) Ltd.1,0*U#Thawte Personal Freemail Issuing CAmtv0	+0	*H
	1	*H
0	*H
	1
080514223221Z0#	*H
	1V&'s#F֠UAU0R	*H
	1E0C0
*H
0*H
0
*H
@0+0
*H
(0	+71x0v0b10	UZA1%0#U
Thawte Consulting (Pty) Ltd.1,0*U#Thawte Personal Freemail Issuing CAmtv0*H
	1xv0b10	UZA1%0#U
Thawte Consulting (Pty) Ltd.1,0*U#Thawte Personal Freemail Issuing CAmtv0
	*H
%+.PG5\23[Bw@gK &|g$;NJ;M@jbBN}vՂ#nu2$qgQwyr̵ŘeQ|	?+GrP1^/e;CPe3PzJU`L::|Z4uȒ⍎k!o?*;JP}p[P~~N

pq9Ϲٯozg(\?

Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?482B6875.6070005>