From owner-freebsd-security Thu Jul 18 11:11:26 2002 Delivered-To: freebsd-security@freebsd.org Received: from mx1.FreeBSD.org (mx1.FreeBSD.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id B8C3F37B400 for ; Thu, 18 Jul 2002 11:11:18 -0700 (PDT) Received: from kknd.mweb.co.za (kknd.mweb.co.za [196.2.45.79]) by mx1.FreeBSD.org (Postfix) with ESMTP id EECAE43E67 for ; Thu, 18 Jul 2002 11:11:14 -0700 (PDT) (envelope-from savage@savage.za.org) Received: from cpt-dial-196-30-179-228.mweb.co.za ([196.30.179.228] helo=netsonic.megalan.co.za) by kknd.mweb.co.za with esmtp (Exim 4.01) id 17VFdg-0000Kx-00; Thu, 18 Jul 2002 20:04:33 +0200 Received: from genocide.megalan.co.za ([192.168.1.254] helo=genocide) by netsonic.megalan.co.za with smtp (Exim 3.36 #2) id 17VFjX-000CnC-47; Thu, 18 Jul 2002 20:10:35 +0200 Message-ID: <002f01c22e86$6507caa0$fe01a8c0@genocide> From: "Chris Knipe" To: "Jim Laurenson" , "Craig Miller" , "freebsd-security" References: Subject: Re: wierdness in my security report Date: Thu, 18 Jul 2002 20:10:18 +0200 Organization: MegaLAN Corporate Networking Services MIME-Version: 1.0 Content-Type: multipart/alternative; boundary="----=_NextPart_000_0026_01C22E97.22FA3EC0" X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 6.00.2600.0000 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000 Sender: owner-freebsd-security@FreeBSD.ORG Precedence: bulk List-ID: List-Archive: (Web Archive) List-Help: (List Instructions) List-Subscribe: List-Unsubscribe: X-Loop: FreeBSD.org This is a multi-part message in MIME format. ------=_NextPart_000_0026_01C22E97.22FA3EC0 Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable If it is Cisco, it's more than likely HSRP (Host Standby Router = Protocol). It happens where two different routers are configured in a redundancy = scenario with a "virtual" IP. What will happen, is that x.x.x.1 is a = virtual IP, while x.x.x.2 and x.x.x.3 is assigned to the Ethernet ports. Router 1 which is x.x.x.2 will have the virtual IP of x.x.x.1 on .2's = MAC address, however, when the router goes down, Router 2 reclaims the = virtual IP .1, on the MAC address of .3 =20 Therefore, the MAC address changes, and to my understanding that is what = causes the message to be displayed. I can however, be wrong and the = change or "switching" of one IP to another MAC address may have nothing = to do with the cause of the log message. -- me ----- Original Message -----=20 From: Jim Laurenson=20 To: Craig Miller ; freebsd-security=20 Sent: Thursday, July 18, 2002 7:53 PM Subject: RE: wierdness in my security report I have found the same logs on one of my older builds (4.3 I think). = The offending MAC address was found to be a Cisco router on my ISP's = network. I found no solution for it though. Jim Laurenson -----Original Message----- From: owner-freebsd-security@FreeBSD.ORG = [mailto:owner-freebsd-security@FreeBSD.ORG]On Behalf Of Craig Miller Sent: July 18, 2002 11:47 AM To: freebsd-security Subject: wierdness in my security report Anyone have any ideas as to what might be causing the following to = appear in my security report? arp: 12.236.220.1 moved from 00:b0:64:b7:6f:54 to 00:b0:64:b7:6f:a8 = on dc0 > Jul 17 05:47:56 server /kernel: arp: 12.236.220.1 moved from = 00:b0:64:b7:6f:54 to 00:b0:64:b7:6f:a8 on dc0 > arp: 12.236.220.1 moved from 00:b0:64:b7:6f:a8 to = 00:b0:64:b7:6f:54 on dc0 > Jul 17 05:47:57 server /kernel: arp: 12.236.220.1 moved from = 00:b0:64:b7:6f:a8 to 00:b0:64:b7:6f:54 on dc0 I thought those : delimited fields would be MAC addresses, but they = don't match the MAC addresses of either of the two cards in my free-bsd = box. I have not checked the MAC addresses of the other network cards on = my network. Also, where does the "server /kernel" name come from. "kernel" is = not the name I gave my kernel, so I am suspicious. Thanks, --Craig ------=_NextPart_000_0026_01C22E97.22FA3EC0 Content-Type: text/html; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable
If it is Cisco, it's more than likely = HSRP (Host=20 Standby Router Protocol).
 
It happens where two different routers = are=20 configured in a redundancy scenario with a "virtual" IP.  What will = happen,=20 is that x.x.x.1 is a virtual IP, while x.x.x.2 and x.x.x.3 is assigned = to the=20 Ethernet ports.
 
Router 1 which is x.x.x.2 will have the = virtual IP=20 of x.x.x.1 on .2's MAC address, however, when the router goes down, = Router 2=20 reclaims the virtual IP .1, on the MAC address of .3 
 
Therefore, the MAC address changes, and = to my=20 understanding that is what causes the message to be displayed.  I = can=20 however, be wrong and the change or "switching" of one IP to another MAC = address=20 may have nothing to do with the cause of the log message.
 
--
me
 
 
----- Original Message -----
From:=20 Jim=20 Laurenson
To: Craig Miller ; freebsd-security =
Sent: Thursday, July 18, 2002 = 7:53=20 PM
Subject: RE: wierdness in my = security=20 report

I=20 have found the same logs on one of my older builds (4.3 I think). The=20 offending MAC address was found to be a Cisco router on my ISP's = network. I=20 found no solution for it though.
 
Jim Laurenson
-----Original Message-----
From: owner-freebsd-security= @FreeBSD.ORG=20 [mailto:owner-freebsd-security@FreeBSD.ORG]On Behalf Of Craig = Miller
Sent: July 18, 2002 11:47 AM
To:=20 freebsd-security
Subject: wierdness in my security=20 report

Anyone have any ideas as to what = might be=20 causing the following to appear in my security report?
 
 arp: 12.236.220.1 moved from 00:b0:64:b7:6f:54 to=20 00:b0:64:b7:6f:a8 on dc0
> Jul 17 05:47:56 server /kernel: = arp:=20 12.236.220.1 moved from 00:b0:64:b7:6f:54 to 00:b0:64:b7:6f:a8 on=20 dc0
> arp: 12.236.220.1 moved from 00:b0:64:b7:6f:a8 to=20 00:b0:64:b7:6f:54 on dc0
> Jul 17 05:47:57 server /kernel: = arp:=20 12.236.220.1 moved from 00:b0:64:b7:6f:a8 to 00:b0:64:b7:6f:54 on=20 dc0
I thought those : delimited fields = would be MAC=20 addresses, but they don't match the MAC addresses of either of the = two cards=20 in my free-bsd box.  I have not checked the MAC addresses of = the other=20 network cards on my network.
 
Also, where does the "server = /kernel" name come=20 from.  "kernel" is not the name I gave my kernel, so I am=20 suspicious.
 
Thanks,
 
--Craig
 
------=_NextPart_000_0026_01C22E97.22FA3EC0-- To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-security" in the body of the message