Date: Thu, 18 Jul 2002 17:25:07 -0400 From: Dragan Mickovic <dmickovic@verio.net> To: "Z. Frazier" <zfrazier@u.washington.edu> Cc: faSty <fasty@i-sphere.com>, Craig Miller <craig@millerfam.net>, freebsd-security@freebsd.org Subject: Re: wierdness in my security report Message-ID: <20020718172507.A40165@verio.net> In-Reply-To: <Pine.A41.4.44.0207181347360.100196-100000@dante35.u.washington.edu>; from zfrazier@u.washington.edu on Thu, Jul 18, 2002 at 01:52:51PM -0700 References: <20020718204203.GA71330@i-sphere.com> <Pine.A41.4.44.0207181347360.100196-100000@dante35.u.washington.edu>
next in thread | previous in thread | raw e-mail | index | archive | help
As somebody previosly stated on this list, this is normal for HSRP. 12.236.220.1 is a virtual IP and has 2 or more switch's in the background. So anytime the primary goes down (reset, overload, load balancing, error), the HSRP will switch to the backup line and there for the MAC address will change. I don't know how they have it configured, but if the primary comes back to normal operation and has a higher prioraty than the secondary switch the RP will go back to using the primary switch and there for will change the MAC address again. dragan On Thu, Jul 18, 2002 at 01:52:51PM -0700, Z. Frazier wrote: > > I dont have my logs in front of me, but i remember getting something > similar when my ATT cable connection goes down. > > You are right that they disagree over who gets the IP address, the owner > will switch everytime the ATT network goes down and comes back up. > > I am however basing most of this on what a freind told me about my similar > logs. > > The good news is that you can parse your logs for such events and get > reimbursed for the time your network was down. > > > -zach > > On Thu, 18 Jul 2002, faSty wrote: > > > DO you have bridge on your server? > > > > I have that same similar and the bridge 2 ethernet port fight over who master the > > primary IP address. > > > > -fasty > > > > On Thu, Jul 18, 2002 at 10:47:21AM -0700, Craig Miller wrote: > > > Anyone have any ideas as to what might be causing the following to appear in my security report? > > > > > > arp: 12.236.220.1 moved from 00:b0:64:b7:6f:54 to 00:b0:64:b7:6f:a8 on dc0 > > > > Jul 17 05:47:56 server /kernel: arp: 12.236.220.1 moved from 00:b0:64:b7:6f:54 to 00:b0:64:b7:6f:a8 on dc0 > > > > arp: 12.236.220.1 moved from 00:b0:64:b7:6f:a8 to 00:b0:64:b7:6f:54 on dc0 > > > > Jul 17 05:47:57 server /kernel: arp: 12.236.220.1 moved from 00:b0:64:b7:6f:a8 to 00:b0:64:b7:6f:54 on dc0 > > > > > > I thought those : delimited fields would be MAC addresses, but they don't match the MAC addresses of either of the two cards in my free-bsd box. I have not checked the MAC addresses of the other network cards on my network. > > > > > > Also, where does the "server /kernel" name come from. "kernel" is not the name I gave my kernel, so I am suspicious. > > > > > > Thanks, > > > > > > --Craig > > > > > > > > > To Unsubscribe: send mail to majordomo@FreeBSD.org > > with "unsubscribe freebsd-security" in the body of the message > > > > > To Unsubscribe: send mail to majordomo@FreeBSD.org > with "unsubscribe freebsd-security" in the body of the message -- Dragan Mickovic UNIX Systems Administrator NTT/Verio x.4012 To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-security" in the body of the message
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20020718172507.A40165>