Date: Mon, 23 Apr 2001 13:13:24 +0200 From: "Morten A . Middelthon" <morten@freenix.no> To: freebsd-stable@FreeBSD.ORG Subject: Re: arp: unknown hardware address format (0x4500) Message-ID: <20010423131324.C48238@freenix.no> In-Reply-To: <20010410185124.B42234@sunbay.com>; from ru@FreeBSD.ORG on Tue, Apr 10, 2001 at 06:51:24PM %2B0300 References: <20010410161112.A21375@freenix.no> <20010410185124.B42234@sunbay.com>
next in thread | previous in thread | raw e-mail | index | archive | help
On Tue, Apr 10, 2001 at 06:51:24PM +0300, Ruslan Ermilov wrote: > I ran tcpdump(1) for a while to see the hardware address of the host that > broadcasted these wrong ARP messages. You might also want to take a look > at the <net/if_arp.h> header file for the format of the ARP message, and > to take an idea on what fields to look in the tcpdump(1) output. > > I think, something like this might work for you: > > # tcpdump -exn "arp[0]=0x45 and arp[1]=0" Yup, it worked! Seems like it came from a borked Red Hat box, which used dhcp from my FreeBSD dhcpd server. Thanks! -- Morten A. Middelthon Freenix Norge http://www.freenix.no/ -- I love deadlines. I especially like the whooshing sound they make as they go flying by. -- Dilbert To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-stable" in the body of the message
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20010423131324.C48238>