From owner-freebsd-security Thu Jul 18 13:53: 2 2002 Delivered-To: freebsd-security@freebsd.org Received: from mx1.FreeBSD.org (mx1.FreeBSD.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id B0BE937B400 for ; Thu, 18 Jul 2002 13:52:57 -0700 (PDT) Received: from mxout1.cac.washington.edu (mxout1.cac.washington.edu [140.142.32.5]) by mx1.FreeBSD.org (Postfix) with ESMTP id 77EDD43E31 for ; Thu, 18 Jul 2002 13:52:53 -0700 (PDT) (envelope-from zfrazier@u.washington.edu) Received: from mailscan-out1.cac.washington.edu (mailscan-out1.cac.washington.edu [140.142.32.17]) by mxout1.cac.washington.edu (8.12.1+UW01.12/8.12.1+UW02.06) with SMTP id g6IKqqR6010585 for ; Thu, 18 Jul 2002 13:52:52 -0700 Received: FROM dante35.u.washington.edu BY mailscan-out1.cac.washington.edu ; Thu Jul 18 13:52:52 2002 -0700 Received: from localhost (zfrazier@localhost) by dante35.u.washington.edu (8.12.1+UW01.12/8.12.1+UW02.01) with ESMTP id g6IKqpRI008258; Thu, 18 Jul 2002 13:52:51 -0700 Date: Thu, 18 Jul 2002 13:52:51 -0700 (PDT) From: "Z. Frazier" To: faSty Cc: Craig Miller , Subject: Re: wierdness in my security report In-Reply-To: <20020718204203.GA71330@i-sphere.com> Message-ID: MIME-Version: 1.0 Content-Type: TEXT/PLAIN; charset=US-ASCII Sender: owner-freebsd-security@FreeBSD.ORG Precedence: bulk List-ID: List-Archive: (Web Archive) List-Help: (List Instructions) List-Subscribe: List-Unsubscribe: X-Loop: FreeBSD.org I dont have my logs in front of me, but i remember getting something similar when my ATT cable connection goes down. You are right that they disagree over who gets the IP address, the owner will switch everytime the ATT network goes down and comes back up. I am however basing most of this on what a freind told me about my similar logs. The good news is that you can parse your logs for such events and get reimbursed for the time your network was down. -zach On Thu, 18 Jul 2002, faSty wrote: > DO you have bridge on your server? > > I have that same similar and the bridge 2 ethernet port fight over who master the > primary IP address. > > -fasty > > On Thu, Jul 18, 2002 at 10:47:21AM -0700, Craig Miller wrote: > > Anyone have any ideas as to what might be causing the following to appear in my security report? > > > > arp: 12.236.220.1 moved from 00:b0:64:b7:6f:54 to 00:b0:64:b7:6f:a8 on dc0 > > > Jul 17 05:47:56 server /kernel: arp: 12.236.220.1 moved from 00:b0:64:b7:6f:54 to 00:b0:64:b7:6f:a8 on dc0 > > > arp: 12.236.220.1 moved from 00:b0:64:b7:6f:a8 to 00:b0:64:b7:6f:54 on dc0 > > > Jul 17 05:47:57 server /kernel: arp: 12.236.220.1 moved from 00:b0:64:b7:6f:a8 to 00:b0:64:b7:6f:54 on dc0 > > > > I thought those : delimited fields would be MAC addresses, but they don't match the MAC addresses of either of the two cards in my free-bsd box. I have not checked the MAC addresses of the other network cards on my network. > > > > Also, where does the "server /kernel" name come from. "kernel" is not the name I gave my kernel, so I am suspicious. > > > > Thanks, > > > > --Craig > > > > > To Unsubscribe: send mail to majordomo@FreeBSD.org > with "unsubscribe freebsd-security" in the body of the message > To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-security" in the body of the message