From owner-freebsd-questions Wed Jun 6 17:29:53 2001 Delivered-To: freebsd-questions@freebsd.org Received: from empty1.ekahuna.com (empty1.ekahuna.com [198.144.200.196]) by hub.freebsd.org (Postfix) with ESMTP id 272D237B405 for ; Wed, 6 Jun 2001 17:29:49 -0700 (PDT) (envelope-from pjklist@ekahuna.com) Received: from pc-02 (pc02.ekahuna.com [198.144.200.197]) by empty1.ekahuna.com (Post.Office MTA v3.5.3 release 223 ID# 0-0U10L2S100V35) with ESMTP id com for ; Wed, 6 Jun 2001 17:29:48 -0700 From: "Philip J. Koenig" Organization: The Electric Kahuna Organization To: questions@FreeBSD.ORG Date: Wed, 6 Jun 2001 17:29:47 -0700 MIME-Version: 1.0 Content-type: text/plain; charset=US-ASCII Content-transfer-encoding: 7BIT Subject: Re: "Unknown hardware address format" Reply-To: pjklist@ekahuna.com Message-ID: <3B1E688B.26258.D842CF@localhost> In-reply-to: <17c59317ef57.17ef5717c593@bowdoin.edu> X-mailer: Pegasus Mail for Win32 (v3.12c) Sender: owner-freebsd-questions@FreeBSD.ORG Precedence: bulk List-ID: List-Archive: (Web Archive) List-Help: (List Instructions) List-Subscribe: List-Unsubscribe: X-Loop: FreeBSD.ORG Very interesting.. well take a look at these archived messages. I'd love to capture the packets too but they happen so rarely here I might have to capture tons of stuff: http://docs.freebsd.org/cgi/getmsg.cgi?fetch=1844097+0+archive/2000/freebsd-questions/20000806.freebsd-questions http://docs.freebsd.org/cgi/getmsg.cgi?fetch=1866032+0+archive/2000/freebsd-questions/20000806.freebsd-questions (it's a pity I could only find those messages with an external search engine, the www.freebsd.org archive didn't find them) Phil On 6 Jun 2001, at 17:09, Matthew K. Cowger boldly uttered: > Philip, et. al. > > I get these as well, somedays alot of them, some days not. I am > running in a mixed environment (5+ DEC Alphas, 20+ COmpaq NT Boxes, > Dell Linux Boxes, and a couple macs), And these Unknown Hardware > Address fromat messages endup in my logs on my BSD box all day long > (old Compaq 266 w/ Intel EtherExpress PRo 10/100). I'll be happy to > sent any log output...it would be nice to get rid of these, or find out > what machine is sending them. > > .matt > > ----- Original Message ----- > From: "Philip J. Koenig" > Date: Wednesday, June 6, 2001 5:04 pm > Subject: "Unknown hardware address format" > > > I posted a similiar question to this list and the Security list on > > 5/28 and didn't get any definitive replies. > > > > Today I am seeing the same message, out of the blue, in my syslog > > and > > echoed to console (4.3-STABLE): > > > > io /kernel: arp: unknown hardware address format (0x0800) > > > > I searched the mailing list archives to no avail, but ran across > > some > > stuff on altavista, apparently 0800 matches both IP and arp > > protocol > > numbers, here is apparently some kernel code that generates this > > message (if_ether.c), from the URL below: > > > > http://minnie.tuhs.org/FreeBSD- > > srctree/newsrc/netinet/if_ether.c.html > > ----------------- Begin code snippet -------------------- > > if (ntohs(ar->ar_hrd) != ARPHRD_ETHER > > && ntohs(ar->ar_hrd) != ARPHRD_IEEE802) { > > log(LOG_ERR, > > "arp: unknown hardware address format (0x%2D)\n", > > (unsigned char *)&ar->ar_hrd, ""); > > m_freem(m); > > continue; > > } > > --------------------- End code snippet ------------------ > > > > > > I keep worrying it may be a security breach or something, or maybe > > a > > piece of failing network hardware. I'd rather not join one of the > > kernel lists just to ask this question, so if anyone is a > > kernel/net > > hacker or would like to forward it to one, i'd appreciate it.. -- Philip J. Koenig pjklist@ekahuna.com Electric Kahuna Systems -- Computers & Communications for the New Millenium To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-questions" in the body of the message