From owner-freebsd-security Thu Nov 15 19:21:50 2001 Delivered-To: freebsd-security@freebsd.org Received: from mercury.ccmr.cornell.edu (mercury.ccmr.cornell.edu [128.84.231.97]) by hub.freebsd.org (Postfix) with ESMTP id 6C37537B41A for ; Thu, 15 Nov 2001 19:21:48 -0800 (PST) Received: from ruby.ccmr.cornell.edu (IDENT:0@ruby.ccmr.cornell.edu [128.84.231.115]) by mercury.ccmr.cornell.edu (8.9.3/8.9.3) with ESMTP id WAA32400; Thu, 15 Nov 2001 22:22:46 -0500 Received: from localhost (mitch@localhost) by ruby.ccmr.cornell.edu (8.9.3/8.9.3) with ESMTP id WAA21816; Thu, 15 Nov 2001 22:21:44 -0500 X-Authentication-Warning: ruby.ccmr.cornell.edu: mitch owned process doing -bs Date: Thu, 15 Nov 2001 22:21:44 -0500 (EST) From: Mitch Collinsworth X-Sender: mitch@ruby.ccmr.cornell.edu To: Greg Cc: security@FreeBSD.ORG Subject: Re: Re[2]: unusual log in var/log/messages In-Reply-To: <12126694534.20011115181537@rapidfx.com> Message-ID: MIME-Version: 1.0 Content-Type: TEXT/PLAIN; charset=US-ASCII Sender: owner-freebsd-security@FreeBSD.ORG Precedence: bulk List-ID: List-Archive: (Web Archive) List-Help: (List Instructions) List-Subscribe: List-Unsubscribe: X-Loop: FreeBSD.org On Thu, 15 Nov 2001, Greg Wirth wrote: > I also see these from time to time, and have never pinned down > exactly what it means. I've never found any damage or abuse > during or after these messages. I would really like to know. > The times always match, and happen at random times. > Versions don't seem to matter, as it has happened since 3.3 > > Nov 12 06:18:41 aix /kernel: arp: 24.237.82.161 moved from > 00:40:c7:81:22:04 to 00:04:ac:1a:4e:e7 on dc0 > Nov 12 06:18:41 aix /kernel: arp: 24.237.82.161 moved from > 00:04:ac:1a:4e:e7 to 00:40:c7:81:22:04 on dc0 Have you checked to find out which system(s) are involved? It has to be someone on the same subnet with you. -Mitch To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-security" in the body of the message