From owner-freebsd-stable Tue Apr 10 8:51:43 2001 Delivered-To: freebsd-stable@freebsd.org Received: from whale.sunbay.crimea.ua (whale.sunbay.crimea.ua [212.110.138.65]) by hub.freebsd.org (Postfix) with ESMTP id D189337B422 for ; Tue, 10 Apr 2001 08:51:36 -0700 (PDT) (envelope-from ru@whale.sunbay.crimea.ua) Received: (from ru@localhost) by whale.sunbay.crimea.ua (8.11.2/8.11.2) id f3AFpOY46685; Tue, 10 Apr 2001 18:51:24 +0300 (EEST) (envelope-from ru) Date: Tue, 10 Apr 2001 18:51:24 +0300 From: Ruslan Ermilov To: "Morten A . Middelthon" Cc: freebsd-stable@FreeBSD.ORG Subject: Re: arp: unknown hardware address format (0x4500) Message-ID: <20010410185124.B42234@sunbay.com> Mail-Followup-To: "Morten A . Middelthon" , freebsd-stable@FreeBSD.ORG References: <20010410161112.A21375@freenix.no> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline User-Agent: Mutt/1.2.5i In-Reply-To: <20010410161112.A21375@freenix.no>; from morten@freenix.no on Tue, Apr 10, 2001 at 04:11:12PM +0200 Sender: owner-freebsd-stable@FreeBSD.ORG Precedence: bulk X-Loop: FreeBSD.ORG On Tue, Apr 10, 2001 at 04:11:12PM +0200, Morten A . Middelthon wrote: > > Recently I've been getting tons of these in my syslog: > arp: unknown hardware address format (0x4500) > > Iirc I haven't had these before, but now they keep appearing 10-20 times a > day. > > The box is 4.2-STABLE built from sources from Feb 15. There are other FreeBSD > boxes on the same network, but they're not showing any messages like this. > > It's running dhcpd, apache, named, NIS, nfsd, smbd and using an Intel NIC with > the fxp driver, if that's interesting. > This message indicates that some host of your LAN broadcasted ARP message with the wrong value of hardware address format type field. I have a Linux box on my LAN (Mandrake?) that for unknown reason _sometimes_ broadcasts broken ARP requests. These do not hurt anything, just annoying. There is no mechanism to turn these messages off. I ran tcpdump(1) for a while to see the hardware address of the host that broadcasted these wrong ARP messages. You might also want to take a look at the header file for the format of the ARP message, and to take an idea on what fields to look in the tcpdump(1) output. I think, something like this might work for you: # tcpdump -exn "arp[0]=0x45 and arp[1]=0" Cheers, -- Ruslan Ermilov Oracle Developer/DBA, ru@sunbay.com Sunbay Software AG, ru@FreeBSD.org FreeBSD committer, +380.652.512.251 Simferopol, Ukraine http://www.FreeBSD.org The Power To Serve http://www.oracle.com Enabling The Information Age To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-stable" in the body of the message