Date: Sun, 23 Apr 2000 18:49:05 -0400 From: "Crist J. Clark" <cjc@cc942873-a.ewndsr1.nj.home.com> To: Dan Larsson <dl@tyfon.net> Cc: "'miy'" <miyako@sakr.net>, freebsd-questions@FreeBSD.ORG Subject: Re: network replies causing system messages flooding Message-ID: <20000423184904.F70371@cc942873-a.ewndsr1.nj.home.com> In-Reply-To: <000801bfad5b$dea8d920$1401a8c0@intranet.tyfon.net>; from dl@tyfon.net on Sun, Apr 23, 2000 at 09:41:07PM %2B0200 References: <Pine.BSF.4.10.10004231516090.474-100000@sakr.net> <000801bfad5b$dea8d920$1401a8c0@intranet.tyfon.net>
index | next in thread | previous in thread | raw e-mail
On Sun, Apr 23, 2000 at 09:41:07PM +0200, Dan Larsson wrote:
> | -----Original Message-----
> | From: owner-freebsd-questions@FreeBSD.ORG
> | [mailto:owner-freebsd-questions@FreeBSD.ORG]On Behalf Of miy
> | Sent: Sunday, April 23, 2000 9:18 PM
> | To: cjclark@home.com
> | Cc: freebsd-questions@FreeBSD.ORG
> | Subject: Re: network replies causing system messages flooding
> |
> |
> |
> | My system messages are still being flooded by the following message:
> |
> | arp: 10.0.0.4 is on ed1 but got reply from 00:80:c8:e8:ea:d7 on rl0
> | arp: 10.0.0.4 is on ed1 but got reply from 00:80:c8:e8:ea:d7 on rl0
> |
> | while I try and solve this problem, is there any way I can filter
> | them from system logging?
>
> The options you're looking for are in /etc/syslog.conf. Check line
> which ends with /dev/console.
>
> For further info: man syslog.conf
The problem with trying to stop these at syslogd(8) is that these are
kernel messages being generated at the LOG_ERR level. I really would
not want to toss them out at the expense of losing other messages at
that level. Now, you can run the syslogd output through some type of
filtering program, but that would be a whole other problem with plenty
of gotchas of its own.
The code that generates these messages is in
/usr/src/sys/netinet/if_ether.c,
if (rt->rt_ifp != &ac->ac_if) {
log(LOG_ERR, "arp: %s is on %s%d but got reply from %6D on %s%d\n",
inet_ntoa(isaddr),
rt->rt_ifp->if_name, rt->rt_ifp->if_unit,
ea->arp_sha, ":",
ac->ac_if.if_name, ac->ac_if.if_unit);
goto reply;
}
Now, before anyone uses this patch: I AM NOT A KERNEL HACKER. I DO NOT
KNOW WHAT THE HELL I AM DOING. But the following patch should turn off
those messages if you set,
option ARP_IGNORE_WRONG_IF
In your kernel configuration file.
--- if_ether.c Fri Oct 22 04:02:33 1999
+++ if_ether.c Sun Apr 23 18:45:17 2000
@@ -539,11 +539,13 @@
if (la && (rt = la->la_rt) && (sdl = SDL(rt->rt_gateway))) {
#ifndef BRIDGE /* the following is not an error when doing bridging */
if (rt->rt_ifp != &ac->ac_if) {
+#ifndef ARP_IGNORE_WRONG_IF /* do not log the packet -- NOT RECOMMENDED */
log(LOG_ERR, "arp: %s is on %s%d but got reply from %6D on %s%d\n",
inet_ntoa(isaddr),
rt->rt_ifp->if_name, rt->rt_ifp->if_unit,
ea->arp_sha, ":",
ac->ac_if.if_name, ac->ac_if.if_unit);
+#endif
goto reply;
}
#endif
--
Crist J. Clark cjclark@home.com
To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-questions" in the body of the message
help
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20000423184904.F70371>