Date: Fri, 19 Jul 2002 16:46:30 +0400 From: "Artem 'Zazoobr' Ignatjev" <timon@memphis.mephi.ru> To: Craig Miller <craig@millerfam.net>, freebsd-security@FreeBSD.ORG Subject: Re: wierdness in my security report Message-ID: <20020719164630.B26458@memphis.mephi.ru> In-Reply-To: <006301c22e83$2b3d5b30$fe01a8c0@Desktop>; from craig@millerfam.net on Thu, Jul 18, 2002 at 10:47:21AM -0700 References: <006301c22e83$2b3d5b30$fe01a8c0@Desktop>
next in thread | previous in thread | raw e-mail | index | archive | help
On Thu, Jul 18, 2002 at 10:47:21AM -0700, Craig Miller wrote: > Anyone have any ideas as to what might be causing the following to appear in my security report? > >> Jul 17 05:47:56 server /kernel: arp: 12.236.220.1 moved from 00:b0:64:b7:6f:54 to 00:b0:64:b7:6f:a8 on dc0 >> arp: 12.236.220.1 moved from 00:b0:64:b7:6f:a8 to 00:b0:64:b7:6f:54 on dc0 >> Jul 17 05:47:57 server /kernel: arp: 12.236.220.1 moved from 00:b0:64:b7:6f:a8 to 00:b0:64:b7:6f:54 on dc0 > > I thought those : delimited fields would be MAC addresses, but they don't match the MAC addresses of either of the two >cards in my free-bsd box. I have not checked the MAC addresses of the other network cards on my network. > Also, where does the "server /kernel" name come from. "kernel" is not the name I gave my kernel, so I am suspicious. errr... ls /kernel I think you meant that IDENT line of your kernel configs isn't about kernel, but it installs into / as kernel. The message you see tells you, that IP address changed it hardware addr, and delimited fields really are old and new addys. Sinceherely yours, Artem 'Zazoobr' Ignatjev. To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-security" in the body of the message
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20020719164630.B26458>