From owner-freebsd-questions@FreeBSD.ORG Thu Feb 11 14:44:29 2010 Return-Path: Delivered-To: freebsd-questions@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34]) by hub.freebsd.org (Postfix) with ESMTP id 455E7106566C for ; Thu, 11 Feb 2010 14:44:29 +0000 (UTC) (envelope-from m.seaman@black-earth.co.uk) Received: from smtp.infracaninophile.co.uk (gate6.infracaninophile.co.uk [IPv6:2001:8b0:151:1::1]) by mx1.freebsd.org (Postfix) with ESMTP id C91718FC12 for ; Thu, 11 Feb 2010 14:44:28 +0000 (UTC) Received: from seedling.black-earth.co.uk (seedling.black-earth.co.uk [81.187.76.163]) (authenticated bits=0) by smtp.infracaninophile.co.uk (8.14.4/8.14.4) with ESMTP id o1BEiGi1003111 (version=TLSv1/SSLv3 cipher=DHE-RSA-CAMELLIA256-SHA bits=256 verify=NO); Thu, 11 Feb 2010 14:44:17 GMT (envelope-from m.seaman@black-earth.co.uk) X-DKIM: Sendmail DKIM Filter v2.8.3 smtp.infracaninophile.co.uk o1BEiGi1003111 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=black-earth.co.uk; s=201001-black-earth; t=1265899457; bh=3sFRhwn9ntuCq7/O7HL5Wca/6xKdQKpdgO+Ad4FPvos=; h=Message-ID:Date:From:MIME-Version:To:CC:Subject:References: In-Reply-To:Content-Type:Cc:Content-Type:Date:From:In-Reply-To: Message-ID:Mime-Version:References:To; z=Message-ID:=20<4B7417B8.3060605@black-earth.co.uk>|Date:=20Thu,=2 011=20Feb=202010=2014:44:08=20+0000|From:=20Matthew=20Seaman=20|User-Agent:=20Mozilla/5.0=20(Macintosh=3 B=20U=3B=20Intel=20Mac=20OS=20X=2010.6=3B=20en-GB=3B=20rv:1.9.1.7) =20Gecko/20100111=20Thunderbird/3.0.1|MIME-Version:=201.0|To:=20Ja mes=20Smallacombe=20|CC:=20freebsd-questions@freebsd.org| Subject:=20Re:=20yikes!=20=20MAC=20address=20of=20default=20gatewa y=20changed=20??|References:=20=09=09=09<4B73EC3 1.6030209@black-earth.co.uk>=09=20|In-Reply-To:=20|X-Enigmail-Version:=201.0|Content-Type:=20multipart/signed=3B=2 0micalg=3Dpgp-sha1=3B=0D=0A=20protocol=3D"application/pgp-signatur e"=3B=0D=0A=20boundary=3D"------------enigB72429465B9D3CF93AE4AC13 "; b=BdgQ1R+tEjZMOyezMsXIx4aE+ewFkBi0pC5ex9Cikuf4i06+/iRdLWWJWfbby8IV4 b7zQKbg6JvTYbAhCqK0+RAiiKBvIL+DCH4Nz+TFWjfeePlSqxIPID/rLRa5ooI/1S0 +wcw3aH6AL42wobXi8WSYKkSW1ZyW3iGaBldUvww= Message-ID: <4B7417B8.3060605@black-earth.co.uk> Date: Thu, 11 Feb 2010 14:44:08 +0000 From: Matthew Seaman User-Agent: Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10.6; en-GB; rv:1.9.1.7) Gecko/20100111 Thunderbird/3.0.1 MIME-Version: 1.0 To: James Smallacombe References: <4B73EC31.6030209@black-earth.co.uk> In-Reply-To: X-Enigmail-Version: 1.0 Content-Type: multipart/signed; micalg=pgp-sha1; protocol="application/pgp-signature"; boundary="------------enigB72429465B9D3CF93AE4AC13" X-Virus-Scanned: clamav-milter 0.95.3 at happy-idiot-talk.infracaninophile.co.uk X-Virus-Status: Clean X-Spam-Status: No, score=-1.0 required=5.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_AU,PLING_QUERY,SPF_FAIL,URIBL_RED autolearn=no version=3.3.0 X-Spam-Checker-Version: SpamAssassin 3.3.0 (2010-01-18) on happy-idiot-talk.infracaninophile.co.uk Cc: freebsd-questions@freebsd.org Subject: Re: yikes! MAC address of default gateway changed ?? X-BeenThere: freebsd-questions@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: User questions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 11 Feb 2010 14:44:29 -0000 This is an OpenPGP/MIME signed message (RFC 2440 and 3156) --------------enigB72429465B9D3CF93AE4AC13 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: quoted-printable On 11/02/2010 14:28, James Smallacombe wrote: > If it was caused by a malicious arp command on my server, wouldn't a > reboot have gotten rid of it? Would it also result in a "NO CARRIER" o= n > the interface? Network did not come back until the Ethernet card was > swapped. >=20 > The bottom line is whether it is possible for a NIC failure to cause th= e > kernel to register an ARP change. Yes. Getting 'NO CARRIER' all of a sudden after the NIC has been behaving weirdly looks very much like hardware spiralling into oblivion and not enemy action. Having a corrupted arp cache is also likely a symptom of hardware going bad. NIC failure can have the observed results, and it's quite likely that on reboot the NIC would fail to work entirely in that situation. Actually, one thing it's always a good idea to test in these circumstances is that it's not a broken or loose ethernet cable. This can cause all sorts of similar weirdness, but it's a lot easier and cheaper to fix. I've seen the like sort of problems just from people pulling cable ties too tight. Cheers, Matthew --=20 Dr Matthew J Seaman MA, D.Phil. 7 Priory Courtyard, Flat 3 Black Earth Consulting Ramsgate Kent, CT11 9PW Free and Open Source Solutions Tel: +44 (0)1843 580647 --------------enigB72429465B9D3CF93AE4AC13 Content-Type: application/pgp-signature; name="signature.asc" Content-Description: OpenPGP digital signature Content-Disposition: attachment; filename="signature.asc" -----BEGIN PGP SIGNATURE----- Version: GnuPG/MacGPG2 v2.0.14 (Darwin) Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/ iEYEARECAAYFAkt0F8AACgkQ8Mjk52CukIzA5ACfTsqEMS8ACTG6RigrqSK9E6OD mtIAn1aPXWSgjsugZk48pC7Q8geWeZBQ =OHDZ -----END PGP SIGNATURE----- --------------enigB72429465B9D3CF93AE4AC13--