From owner-freebsd-security Thu Jul 18 11:29:53 2002 Delivered-To: freebsd-security@freebsd.org Received: from mx1.FreeBSD.org (mx1.FreeBSD.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id E6D9637B400 for ; Thu, 18 Jul 2002 11:29:46 -0700 (PDT) Received: from hotmail.com (oe21.law7.hotmail.com [216.33.236.125]) by mx1.FreeBSD.org (Postfix) with ESMTP id 911A343E42 for ; Thu, 18 Jul 2002 11:29:46 -0700 (PDT) (envelope-from elerrordlmilenio@hotmail.com) Received: from mail pickup service by hotmail.com with Microsoft SMTPSVC; Thu, 18 Jul 2002 11:29:46 -0700 X-Originating-IP: [196.40.43.74] From: "El Error del Milenio" To: "Craig Miller" , "freebsd-security" References: <006301c22e83$2b3d5b30$fe01a8c0@Desktop> Subject: Re: wierdness in my security report Date: Thu, 18 Jul 2002 12:30:05 -0600 MIME-Version: 1.0 Content-Type: multipart/alternative; boundary="----=_NextPart_000_005C_01C22E56.D8C8D220" X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 5.50.4807.1700 X-MimeOLE: Produced By Microsoft MimeOLE V5.50.4807.1700 Message-ID: X-OriginalArrivalTime: 18 Jul 2002 18:29:46.0563 (UTC) FILETIME=[17DE3130:01C22E89] Sender: owner-freebsd-security@FreeBSD.ORG Precedence: bulk List-ID: List-Archive: (Web Archive) List-Help: (List Instructions) List-Subscribe: List-Unsubscribe: X-Loop: FreeBSD.org This is a multi-part message in MIME format. ------=_NextPart_000_005C_01C22E56.D8C8D220 Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable I'm also having: > arp: 10.0.0.147 moved from 00:e0:7d:a9:c8:3c to 00:b0:d0:a5:4d:e0 on = rl0 > Jul 1 15:29:26 bella /kernel: arp: 10.0.0.147 moved from = 00:e0:7d:a9:c8:3c to 00:b0:d0:a5:4d:e0 on rl0 I thought it was because of dhcp addresses changing, but now I am in = doubt, since my kernel is not named "kernel" either. ----- Original Message -----=20 From: Craig Miller=20 To: freebsd-security=20 Sent: Thursday, July 18, 2002 11:47 AM Subject: wierdness in my security report Anyone have any ideas as to what might be causing the following to = appear in my security report? arp: 12.236.220.1 moved from 00:b0:64:b7:6f:54 to 00:b0:64:b7:6f:a8 = on dc0 > Jul 17 05:47:56 server /kernel: arp: 12.236.220.1 moved from = 00:b0:64:b7:6f:54 to 00:b0:64:b7:6f:a8 on dc0 > arp: 12.236.220.1 moved from 00:b0:64:b7:6f:a8 to 00:b0:64:b7:6f:54 = on dc0 > Jul 17 05:47:57 server /kernel: arp: 12.236.220.1 moved from = 00:b0:64:b7:6f:a8 to 00:b0:64:b7:6f:54 on dc0 I thought those : delimited fields would be MAC addresses, but they = don't match the MAC addresses of either of the two cards in my free-bsd = box. I have not checked the MAC addresses of the other network cards on = my network. Also, where does the "server /kernel" name come from. "kernel" is not = the name I gave my kernel, so I am suspicious. Thanks, --Craig ------=_NextPart_000_005C_01C22E56.D8C8D220 Content-Type: text/html; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable

I'm also having:

> arp: 10.0.0.147 moved from 00:e0:7d:a9:c8:3c to = 00:b0:d0:a5:4d:e0 on=20 rl0
> Jul 1 15:29:26 bella /kernel: arp: 10.0.0.147 moved = from=20 00:e0:7d:a9:c8:3c to 00:b0:d0:a5:4d:e0 on rl0

I=20 thought it was because of dhcp addresses changing, but now I am in = doubt, since=20 my kernel is not named "kernel" either.

----- Original Message -----
From:=20 Craig=20 Miller
To: freebsd-security =

Sent: Thursday, July 18, 2002 = 11:47=20 AM

Subject: wierdness in my = security=20 report

Anyone have any ideas as to what = might be causing=20 the following to appear in my security report?

arp: 12.236.220.1 moved from 00:b0:64:b7:6f:54 to = 00:b0:64:b7:6f:a8=20 on dc0
> Jul 17 05:47:56 server /kernel: arp: 12.236.220.1 moved = from=20 00:b0:64:b7:6f:54 to 00:b0:64:b7:6f:a8 on dc0
> arp: = 12.236.220.1 moved=20 from 00:b0:64:b7:6f:a8 to 00:b0:64:b7:6f:54 on dc0
> Jul 17 = 05:47:57=20 server /kernel: arp: 12.236.220.1 moved from 00:b0:64:b7:6f:a8 to=20 00:b0:64:b7:6f:54 on dc0

I thought those : delimited fields = would be MAC=20 addresses, but they don't match the MAC addresses of either of the two = cards=20 in my free-bsd box. I have not checked the MAC addresses of the = other=20 network cards on my network.

Also, where does the "server /kernel" = name come=20 from. "kernel" is not the name I gave my kernel, so I am=20 suspicious.

Thanks,

--Craig

------=_NextPart_000_005C_01C22E56.D8C8D220-- To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-security" in the body of the message