From owner-freebsd-questions Fri Apr 26 1:41: 3 2002 Delivered-To: freebsd-questions@freebsd.org Received: from gamma.root-servers.ch (gamma.root-servers.ch [195.49.62.126]) by hub.freebsd.org (Postfix) with SMTP id C8BB837B404 for ; Fri, 26 Apr 2002 01:40:56 -0700 (PDT) Received: (qmail 41878 invoked from network); 26 Apr 2002 08:40:54 -0000 Received: from dclient217-162-131-134.hispeed.ch (HELO athlon550) (217.162.131.134) by 0 with SMTP; 26 Apr 2002 08:40:54 -0000 Date: Fri, 26 Apr 2002 10:43:34 +0200 From: Gabriel Ambuehl X-Mailer: The Bat! (v1.60c) Educational Reply-To: gabriel_ambuehl@buz.ch Organization: BUZ Internet Services X-Priority: 3 (Normal) Message-ID: <158162746907.20020426104334@buz.ch> To: Bill Moran Cc: questions@freebsd.org Subject: Re[2]: dhclient going crazy... In-Reply-To: <3CC86D86.7060100@potentialtech.com> References: <1965488492.20020424150235@buz.ch> <3CC86D86.7060100@potentialtech.com> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: 7bit Sender: owner-freebsd-questions@FreeBSD.ORG Precedence: bulk List-ID: List-Archive: (Web Archive) List-Help: (List Instructions) List-Subscribe: List-Unsubscribe: X-Loop: FreeBSD.ORG -----BEGIN PGP SIGNED MESSAGE----- Hello Bill, Thursday, April 25, 2002, 10:56:38 PM, you wrote: >> this required, nice, uuh) as the ISP feels I've been running DoS >> attacks >> against its DHCP servers: > Sure sounds like bullsh*t to me. I later had a call from one of the NOC guys who actually appeared to know something about the whole issue and he didn't claim I was running DoS but thought that there might be a bug in the dhclient. > From the looks of the arp messages > below, it doesn't look like you're the one changing MAC addresses. Actually, there's a whole lot of those ARP changes for the GW, could it be that dhclient went crazy about it? >> one hour later, went on for about ten minuted and stopped, the >> whole cycle was repeated for several hours from 17:00 to 23:XX. >> What is happening here? And how can I prevent it from happening >> again? > It really looks to me like your ISPs DHCP server is whacked. Maybe > That's originally what I expected to be the reason too but the NOC guy told me that they're running with 60min leases. > it's giving out incredibly short lease times, requiring you to > renew your lease often. Check /var/db/dhclient.leases to see what > the > DHCP server has been up to. Can't do that now cause at the moment, it's working like it should, i.e. no representative data there for me... >> interface in it (its primary job is running ipnat for the LAN >> behind it) (dc0) was experiencing weird problem (watchdog >> timeouts...). > Could be other problems on your end perhaps? Have you monitored > your MAC address while this was happening (via ifconfig) to see if > it was changing? Unfortunately not as I only got to know about it afterwards (and even then only after two days of bothering the helpdesk about my lost of connectivity, cool, eh). > I'm making some guesses here, Gabe, because I've never seen > anything like this before. Neither did I. The box in question has a somewhat doubtful internal (dc0) interface that would generate watchdog alerts from time to time since a few week but despite it was running for more than a year without a single problem. I sure did upgrade it from time to time but as STABLE really is stable for the very most part, I never ever encountered any trouble while on it... Best regards, Gabriel -----BEGIN PGP SIGNATURE----- Version: PGP 6.5i iQEVAwUBPMkFKcZa2WpymlDxAQHKUwf/XoM+7ZzxsKGwuEDQ9+nVzYh67Gz7GrPK CteFSeiL7zPLs0o+VOcRNAi9URF/vSY01UgK6i5A5Bih7v0aflBWQ44cD3JwTj5j rKrl6myyycFLqfwlOJHohGmCH7GXC6+AimfehBslOvXDw3HJ7X0dyRSSS6+Sm3ZE 3wtV7PXybQNikVwj18UA/0KkH+fjZlpWjntBRQNIjT0zO5AVAkeeAixQh0XQHUmT v/EfOpOx+5QDuhIb2le8zDB1b/4yuus8scefnL+FNl/xC4cFVIBs4G2m8w1d/ePO llITpoNO/ZDSKHZlvF/3FWNQiKiCthRhi8oPBVyOfEO1d3Aa39lzJQ== =8KbJ -----END PGP SIGNATURE----- To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-questions" in the body of the message