From owner-freebsd-questions@FreeBSD.ORG Sat Jun 14 07:00:59 2003 Return-Path: Delivered-To: freebsd-questions@freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id F1B5537B401 for ; Sat, 14 Jun 2003 07:00:58 -0700 (PDT) Received: from pa-plum1b-166.pit.adelphia.net (pa-plum1b-217.pit.adelphia.net [24.53.161.217]) by mx1.FreeBSD.org (Postfix) with ESMTP id 8AB6A43FDD for ; Sat, 14 Jun 2003 07:00:57 -0700 (PDT) (envelope-from wmoran@potentialtech.com) Received: from potentialtech.com (working [172.16.0.95]) h5EE0pOg003585; Sat, 14 Jun 2003 10:00:56 -0400 (EDT) (envelope-from wmoran@potentialtech.com) Message-ID: <3EEB2A93.2010904@potentialtech.com> Date: Sat, 14 Jun 2003 10:00:51 -0400 From: Bill Moran User-Agent: Mozilla/5.0 (X11; U; FreeBSD i386; en-US; rv:1.3) Gecko/20030429 X-Accept-Language: en-us, en MIME-Version: 1.0 To: ODHIAMBO Washington References: <20030613152226.GA91843@ns2.wananchi.com> <3EE9EF8D.4070405@potentialtech.com> <20030614095831.GA33616@ns2.wananchi.com> In-Reply-To: <20030614095831.GA33616@ns2.wananchi.com> Content-Type: text/plain; charset=us-ascii; format=flowed Content-Transfer-Encoding: 7bit cc: FBSD-Q Subject: Re: arp messages: Why is this happening? X-BeenThere: freebsd-questions@freebsd.org X-Mailman-Version: 2.1.1 Precedence: list List-Id: User questions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 14 Jun 2003 14:00:59 -0000 ODHIAMBO Washington wrote: > * Bill Moran [20030613 18:36]: wrote: > >>ODHIAMBO Washington wrote: >> >>>My log files (and console) fill up with these messages. >>> >>> >>>>arp: 62.8.64.172 moved from 00:c0:05:11:01:f1 to 00:c0:05:10:01:f1 on bge1 >>>>arp: 62.8.64.201 moved from 00:c0:05:10:01:f1 to 00:c0:05:11:01:f1 on bge1 >>>>arp: 62.8.64.201 moved from 00:c0:05:11:01:f1 to 00:c0:05:10:01:f1 on bge1 >>>>arp: 62.8.64.145 moved from 00:c0:05:11:01:f1 to 00:c0:05:10:01:f1 on bge1 >>>>arp: 62.8.64.212 moved from 00:c0:05:11:01:f1 to 00:c0:05:10:01:f1 on bge1 >>>>arp: 62.8.64.188 moved from 00:c0:05:11:01:f1 to 00:c0:05:10:01:f1 on bge1 >> >>Could be that you're on a DHCP network and addresses are moving around a >>lot. > > An ISP env, without a DHCP server, but with a NAS assigning IPs to dialup clients. For all intents and purposes, that's the same as a DHCP server in it's affect on arp. 'netstat -rn' should give you IPs and MAC addresses. You could monitor that to get an idea of what the IPs are doing and possibly improve the configuration of the NAS to reduce the problem. >>There is a sysctl that will turn off reporting of this: >>net.link.ether.inet.log_arp_movements >>Set it to 0 to stop the logging. > > Thanks. I was looking for something like this, but is this really available > in 4.8-STABLE ???? It's available earlier than that. I don't know exactly when it was added, but it's definately in 4.8. If you're the ISP, you may want to consider researching the problem before you blindly turn this off. Although you could turn the messages off, put it on your list of things to do, and turn them back on in a month or whatever when you had more time to research the problem. -- Bill Moran Potential Technologies http://www.potentialtech.com