Date: Thu, 15 May 2008 08:25:30 -0400 From: Jon Radel <jon@radel.com> To: Christer Solskogen <solskogen@carebears.mine.nu> Cc: freebsd-questions@freebsd.org Subject: Re: arplookup 0.0.0.0 failed: host is not on local network Message-ID: <482C2BBA.3070305@radel.com> In-Reply-To: <482BE2BA.6050105@carebears.mine.nu> References: <g07lip$736$1@ger.gmane.org> <6.0.0.22.2.20080511190114.0264af00@mail.computinginnovations.com> <g09t4u$ads$1@ger.gmane.org> <g0a0aa$lip$1@ger.gmane.org> <6.0.0.22.2.20080512153543.02665c88@mail.computinginnovations.com> <g0aa89$q0p$1@ger.gmane.org> <6.0.0.22.2.20080512163401.026387f8@mail.computinginnovations.com> <g0ei1m$r0a$1@ger.gmane.org> <6.0.0.22.2.20080514131710.025269f0@mail.computinginnovations.com> <g0fms3$8qs$1@ger.gmane.org> <482B6875.6070005@radel.com> <482B6F21.2040602@radel.com> <482BE2BA.6050105@carebears.mine.nu>
next in thread | previous in thread | raw e-mail | index | archive | help
[-- Attachment #1 --] Christer Solskogen wrote: > [root@shine ~]# tcpdump -vvv -n -l -e arp > tcpdump: listening on nfe0, link-type EN10MB (Ethernet), capture size 96 > bytes > 08:58:46.337968 00:1d:60:36:34:a6 > ff:ff:ff:ff:ff:ff, ethertype ARP > (0x0806), length 60: arp who-has 192.168.0.3 tell 192.168.0.12 > 08:58:46.337974 00:18:f3:29:d8:15 > 00:1d:60:36:34:a6, ethertype ARP > (0x0806), length 42: arp reply 192.168.0.3 is-at 00:18:f3:29:d8:15 ...snip... > > There is this line saying: > 00:1d:60:36:34:a6 > ff:ff:ff:ff:ff:ff > and nothing has ff:ff:ff:ff:ff:ff as a mac address :) ff:ff:ff:ff:ff:ff is the broadcast address. That looks like a rather mundane arp request broadcast followed by a reply from the machine with the address in question. The trick will be to see if you see anything with tcpdump at the time one of the syslog messages about 0.0.0.0 gets logged. BTW, just for the record, personally I doubt this is anything serious to worry about, but as I have no real evidence for that feeling.... You may, however, find http://en.wikipedia.org/wiki/0.0.0.0 at least mildly interesting. --Jon Radel [-- Attachment #2 --] 0 *H 01 0 + 0 *H 100\mtv0 *H 0b1 0 UZA1%0#U Thawte Consulting (Pty) Ltd.1,0*U#Thawte Personal Freemail Issuing CA0 080324165921Z 090324165921Z0^10 URadel10U* Jon Thomas10UJon Thomas Radel1 0 *H jon@radel.com0"0 *H 0 t,P p# ٬q_2=L-^m >z3ʟV![([ AoE}ϛ3/6?cWx(/)'$6sTl<*i'=uox Mbt rdtnxud1R6T>zU0FZ,vN9NP{>qE`^P; *Wg/jN*OVՠQMB(=: *0(0U 0 jon@radel.com0 U 0 0 *H h!oܨ[А!fN#[Z b$3?x&$~Ħ9}`MX[It}/bXZajgxɥ' 2NrtWAr sFި'^@mDVw\)00\mtv0 *H 0b1 0 UZA1%0#U Thawte Consulting (Pty) Ltd.1,0*U#Thawte Personal Freemail Issuing CA0 080324165921Z 090324165921Z0^10 URadel10U* Jon Thomas10UJon Thomas Radel1 0 *H jon@radel.com0"0 *H 0 t,P p# ٬q_2=L-^m >z3ʟV![([ AoE}ϛ3/6?cWx(/)'$6sTl<*i'=uox Mbt rdtnxud1R6T>zU0FZ,vN9NP{>qE`^P; *Wg/jN*OVՠQMB(=: *0(0U 0 jon@radel.com0 U 0 0 *H h!oܨ[А!fN#[Z b$3?x&$~Ħ9}`MX[It}/bXZajgxɥ' 2NrtWAr sFި'^@mDVw\)0?0 0 *H 01 0 UZA10U Western Cape10U Cape Town10U Thawte Consulting1(0&U Certification Services Division1$0"UThawte Personal Freemail CA1+0) *H personal-freemail@thawte.com0 030717000000Z 130716235959Z0b1 0 UZA1%0#U Thawte Consulting (Pty) Ltd.1,0*U#Thawte Personal Freemail Issuing CA00 *H 0 Ħ<UsUNʙZ hup [v :aQP 0cZ,p+Z?qV˯< 6$*+w=+>@dקe*TH<a@ dr` 00U 0 0CU <0:08642http://crl.thawte.com/ThawtePersonalFreemailCA.crl0 U 0)U "0 0 10UPrivateLabel2-1380 *H HP . fgCL!6 -6/ P p<ab:~ t%Pb'qW%ݩ9 Oe_N4[5MwV!x!5$ F]_eO1d0`0v0b1 0 UZA1%0#U Thawte Consulting (Pty) Ltd.1,0*U#Thawte Personal Freemail Issuing CAmtv0 + 0 *H 1 *H 0 *H 1 080515122530Z0# *H 1XW =Ъ<>0R *H 1E0C0 *H 0*H 0 *H @0+0 *H (0 +71x0v0b1 0 UZA1%0#U Thawte Consulting (Pty) Ltd.1,0*U#Thawte Personal Freemail Issuing CAmtv0 *H 1xv0b1 0 UZA1%0#U Thawte Consulting (Pty) Ltd.1,0*U#Thawte Personal Freemail Issuing CAmtv0 *H h);~oה_ _z|P,\3|3]ݿim|x<Ɗޑ In&3\/8;cɚe%ԪaaVUr$ZH72eN511UQBۓ%yeW@/'G2 H. 6r_ "1nMl ;+(\8D# wםOEMM?,0$=
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?482C2BBA.3070305>