From owner-freebsd-questions Wed Apr 19 20: 2:26 2000 Delivered-To: freebsd-questions@freebsd.org Received: from cc942873-a.ewndsr1.nj.home.com (cc942873-a.ewndsr1.nj.home.com [24.2.89.207]) by hub.freebsd.org (Postfix) with ESMTP id 3676F37BD79 for ; Wed, 19 Apr 2000 20:02:22 -0700 (PDT) (envelope-from cjc@cc942873-a.ewndsr1.nj.home.com) Received: (from cjc@localhost) by cc942873-a.ewndsr1.nj.home.com (8.9.3/8.9.3) id XAA59428; Wed, 19 Apr 2000 23:01:49 -0400 (EDT) (envelope-from cjc) Date: Wed, 19 Apr 2000 23:01:49 -0400 From: "Crist J. Clark" To: miy Cc: freebsd-questions@FreeBSD.ORG Subject: Re: network replies causing system messages flooding Message-ID: <20000419230149.B59041@cc942873-a.ewndsr1.nj.home.com> Reply-To: cjclark@home.com References: <20000417225020.A52719@cc942873-a.ewndsr1.nj.home.com> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii X-Mailer: Mutt 1.0i In-Reply-To: ; from miyako@sakr.net on Wed, Apr 19, 2000 at 01:20:49PM -0400 Sender: owner-freebsd-questions@FreeBSD.ORG Precedence: bulk X-Loop: FreeBSD.ORG On Wed, Apr 19, 2000 at 01:20:49PM -0400, miy wrote: > > > On Mon, 17 Apr 2000, Crist J. Clark wrote: > > > On Mon, Apr 17, 2000 at 06:56:47PM -0400, miy wrote: > > > On Sun, 16 Apr 2000, Crist J. Clark wrote: > > > > On Sun, Apr 16, 2000 at 01:22:06AM -0400, miy wrote: > > > > > > > > > > I originally had a windows box [10.0.0.2] connected to my cable connection > > > > > through a FreeBSD gateway running natd. I recently added a second windows > > > > > box to the network, and I it connects properly to the gateway, but I am > > > > > getting flooded by the following system message: > > > > > > > > > > arp: 10.0.0.4 is on ed1 but got reply from 00:80:c8:e8:ea:d7 on rl0 > > > > > arp: 10.0.0.4 is on ed1 but got reply from 00:80:c8:e8:ea:d7 on rl0 > > > > > arp: 10.0.0.4 is on ed1 but got reply from 00:80:c8:e8:ea:d7 on rl0 > > > > > arp: 10.0.0.4 is on ed1 but got reply from 00:80:c8:e8:ea:d7 on rl0 [snip] > this is the output of ifconfig: > > rl0: flags=8843 mtu 1500 > inet6 fe80::2e0:29ff:fe54:a201%rl0 prefixlen 64 scopeid 0x1 > inet 24.114.39.136 netmask 0xfffffc00 broadcast 24.114.39.255 > ether 00:e0:29:54:a2:01 Not here. > media: autoselect (none) status: active > supported media: autoselect 100baseTX 100baseTX > 10baseT/UT > P 10baseT/UTP 100baseTX > lp0: flags=8810 mtu 1500 > ed1: flags=8843 mtu 1500 > inet 10.0.0.1 netmask 0xffffff00 broadcast 10.0.0.255 > inet6 fe80::240:5ff:fe71:498c%ed1 prefixlen 64 scopeid 0x3 > ether 00:40:05:71:49:8c Not here. > sl0: flags=c010 mtu 552 > ppp0: flags=8010 mtu 1500 > lo0: flags=8049 mtu 16384 > inet6 fe80::1%lo0 prefixlen 64 scopeid 0x6 > inet6 ::1 prefixlen 128 > inet 127.0.0.1 netmask 0xffffff00 > gif0: flags=8010 mtu 1280 > inet6 fe80::2e0:29ff:fe54:a201%gif0 prefixlen 64 scopeid 0x7 > > and the output of arp -a is: > > sakr.net (10.0.0.1) at 0:40:5:71:49:8c permanent [ethernet] Not here. > ? (10.0.0.2) at 0:80:c6:f9:a5:55 [ethernet] Not here. > ? (10.0.0.4) at 0:e0:29:54:9f:a6 [ethernet] > bb1-fe1-1.ym1.on.home.net (24.114.36.1) at 0:60:5c:76:5b:21 [ethernet] Not here. > The associated hardware seems to be my network card on the windows box > (10.0.0.2), although these messages were not occuring when I was connected > to the HUB alone on the network. Every since I added the other machine the > sys logs have been displaying the same errors. That MAC address in the messages does not seem to belong to any of your hardware. That would normally lead me to believe that the 10.0.0.4 address is leaking onto the net from someone else's setup. However, if it is coming over the cable modem, I would expect the MAC address to be that of your modem. I thought that's how cable modem's bridged and that's how mine works. Could you try this, # tcpdump -en 'ether proto \arp || host 10.0.0.4' And save the output. It might be interesting. -- Crist J. Clark cjclark@home.com To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-questions" in the body of the message