Date: Fri, 26 Apr 2002 10:43:34 +0200 From: Gabriel Ambuehl <gabriel_ambuehl@buz.ch> To: Bill Moran <wmoran@potentialtech.com> Cc: questions@freebsd.org Subject: Re[2]: dhclient going crazy... Message-ID: <158162746907.20020426104334@buz.ch> In-Reply-To: <3CC86D86.7060100@potentialtech.com> References: <1965488492.20020424150235@buz.ch> <3CC86D86.7060100@potentialtech.com>
next in thread | previous in thread | raw e-mail | index | archive | help
-----BEGIN PGP SIGNED MESSAGE----- Hello Bill, Thursday, April 25, 2002, 10:56:38 PM, you wrote: >> this required, nice, uuh) as the ISP feels I've been running DoS >> attacks >> against its DHCP servers: > Sure sounds like bullsh*t to me. I later had a call from one of the NOC guys who actually appeared to know something about the whole issue and he didn't claim I was running DoS but thought that there might be a bug in the dhclient. > From the looks of the arp messages > below, it doesn't look like you're the one changing MAC addresses. Actually, there's a whole lot of those ARP changes for the GW, could it be that dhclient went crazy about it? >> one hour later, went on for about ten minuted and stopped, the >> whole cycle was repeated for several hours from 17:00 to 23:XX. >> What is happening here? And how can I prevent it from happening >> again? > It really looks to me like your ISPs DHCP server is whacked. Maybe > That's originally what I expected to be the reason too but the NOC guy told me that they're running with 60min leases. > it's giving out incredibly short lease times, requiring you to > renew your lease often. Check /var/db/dhclient.leases to see what > the > DHCP server has been up to. Can't do that now cause at the moment, it's working like it should, i.e. no representative data there for me... >> interface in it (its primary job is running ipnat for the LAN >> behind it) (dc0) was experiencing weird problem (watchdog >> timeouts...). > Could be other problems on your end perhaps? Have you monitored > your MAC address while this was happening (via ifconfig) to see if > it was changing? Unfortunately not as I only got to know about it afterwards (and even then only after two days of bothering the helpdesk about my lost of connectivity, cool, eh). > I'm making some guesses here, Gabe, because I've never seen > anything like this before. Neither did I. The box in question has a somewhat doubtful internal (dc0) interface that would generate watchdog alerts from time to time since a few week but despite it was running for more than a year without a single problem. I sure did upgrade it from time to time but as STABLE really is stable for the very most part, I never ever encountered any trouble while on it... Best regards, Gabriel -----BEGIN PGP SIGNATURE----- Version: PGP 6.5i iQEVAwUBPMkFKcZa2WpymlDxAQHKUwf/XoM+7ZzxsKGwuEDQ9+nVzYh67Gz7GrPK CteFSeiL7zPLs0o+VOcRNAi9URF/vSY01UgK6i5A5Bih7v0aflBWQ44cD3JwTj5j rKrl6myyycFLqfwlOJHohGmCH7GXC6+AimfehBslOvXDw3HJ7X0dyRSSS6+Sm3ZE 3wtV7PXybQNikVwj18UA/0KkH+fjZlpWjntBRQNIjT0zO5AVAkeeAixQh0XQHUmT v/EfOpOx+5QDuhIb2le8zDB1b/4yuus8scefnL+FNl/xC4cFVIBs4G2m8w1d/ePO llITpoNO/ZDSKHZlvF/3FWNQiKiCthRhi8oPBVyOfEO1d3Aa39lzJQ== =8KbJ -----END PGP SIGNATURE----- To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-questions" in the body of the message
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?158162746907.20020426104334>