From owner-freebsd-net@FreeBSD.ORG Wed Sep 4 00:36:51 2013 Return-Path: Delivered-To: freebsd-net@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [8.8.178.115]) (using TLSv1 with cipher ADH-AES256-SHA (256/256 bits)) (No client certificate requested) by hub.freebsd.org (Postfix) with ESMTP id C4C65F84 for ; Wed, 4 Sep 2013 00:36:51 +0000 (UTC) (envelope-from ddesimone@verio.net) Received: from relay2-bcrtfl2.verio.net (relay2-bcrtfl2.verio.net [131.103.218.177]) by mx1.freebsd.org (Postfix) with ESMTP id 76ECC29B3 for ; Wed, 4 Sep 2013 00:36:51 +0000 (UTC) Received: from iad-wprd-xchw01.corp.verio.net (iad-wprd-xchw01.corp.verio.net [198.87.7.164]) by relay2-bcrtfl2.verio.net (Postfix) with ESMTP id C93711FF0018 for ; Tue, 3 Sep 2013 20:10:02 -0400 (EDT) thread-index: Ac6pAxnmNjkgTtsGQhWc8vj3Y3Vwxg== Received: from hometx-733b1p1.corp.verio.net ([10.144.2.53]) by iad-wprd-xchw01.corp.verio.net over TLS secured channel with Microsoft SMTPSVC(6.0.3790.4675); Tue, 3 Sep 2013 20:10:01 -0400 Received: by hometx-733b1p1.corp.verio.net (sSMTP sendmail emulation); Tue, 03 Sep 2013 19:09:59 -0500 Date: Tue, 3 Sep 2013 19:09:59 -0500 Content-Transfer-Encoding: 7bit From: "David DeSimone" To: Content-class: urn:content-classes:message X-MimeOLE: Produced By Microsoft MimeOLE V6.00.3790.4913 Subject: Re: Question regarding security run output Importance: normal Priority: normal Message-ID: <20130904000959.GG19904@verio.net> Mail-Followup-To: freebsd-net@freebsd.org References: MIME-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Disposition: inline In-Reply-To: Precedence: bulk User-Agent: Mutt/1.5.20 (2009-12-10) X-OriginalArrivalTime: 04 Sep 2013 00:10:01.0423 (UTC) FILETIME=[19445DF0:01CEA903] X-BeenThere: freebsd-net@freebsd.org X-Mailman-Version: 2.1.14 List-Id: Networking and TCP/IP with FreeBSD List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 04 Sep 2013 00:36:51 -0000 Kurt Buff wrote: > > Over the three-day US weekend, I was working on some stuff, and found an > interesting set of entries in the daily security run emails all three days. > > The output looks as follows: > > ntop.example.com kernel log messages: > > +++ /tmp/security.IUGsscCR 2013-08-26 03:02:24.000000000 -0700 > > +arp: unknown hardware address format (0x4500) (from 00:05:b7:de:cd:79 to > 72:6e:61:6c:2c:70) > > +arp: unknown hardware address format (0x0100) (from 00:05:b7:de:cd:79 to > 6c:3d:31:37:2c:6e) > > +arp: unknown hardware address format (0x4500) (from 00:05:b7:de:cd:a3 to > 77:72:69:74:74:65) > > +arp: unknown hardware address format (0x0000) (from 00:05:b7:de:cd:71 to > 2d:0d:0a:62:6f:64) These are all interesting because the destination MAC address is composed entirely of valid ASCII characters. 72:6e:61:6c:2c:70 = "rnal,p" 6c:3d:31:37:2c:6e = "l=17,n" 77:72:69:74:74:65 = "writte" 2d:0d:0a:62:6f:64 = "-\r\nbod" > This box is monitoring a mirror port on a procurve switch, using an > unnumbered interface. > > My investigation led me to the engineering lab, and I'm querying them > regarding the equipment, but I don't know what the above entries signal. > Does anyone have a clue they can throw me on this? > > I also find it interesting that the MAC addresses are either unknown, or > belong to Arbor Networks. We don't have any Arbor Networks equipment, > though I suppose they could vend them to an OEM. I'm going to see if I can > trace them down and get some idea of what's running around in that lab. Is there some hardware NIC fault causing DMA from random places in memory on these devices, or some other data leak propogating through the stack on them? It is probably worth capturing the odd packets and analyzing them further to see why they look the way they do. -- David DeSimone == Network Admin == fox@verio.net "I don't like spinach, and I'm glad I don't, because if I liked it I'd eat it, and I just hate it." -- Clarence Darrow This email message is intended for the use of the person to whom it has been sent, and may contain information that is confidential or legally protected. If you are not the intended recipient or have received this message in error, you are not authorized to copy, distribute, or otherwise use this message or its attachments. Please notify the sender immediately by return e-mail and permanently delete this message and any attachments. Verio Inc. makes no warranty that this email is error or virus free. Thank you.