Date: Sun, 18 Jan 2004 16:35:12 +0100 From: Maciej Cetler <airot@lazir.toya.net.pl> To: Spades <spades@galaxynet.org> Cc: freebsd-security@freebsd.org Subject: Re: arp problem in /var/log/messages Message-ID: <20040118153512.GA23872@lazir.toya.net.pl> In-Reply-To: <09bd01c3ddbc$9f829070$fa10fea9@bryanuptrvb0jc> References: <09bd01c3ddbc$9f829070$fa10fea9@bryanuptrvb0jc>
next in thread | previous in thread | raw e-mail | index | archive | help
On Sun, Jan 18, 2004 at 08:14:29PM +0800, Spades wrote: > hi all, i got flooded by these msgs like 1000+ lines, any idea? > my kernel is dated Nov-30 FreeBSD 4.9-stable > > # tail -f /var/log/messages > Jan 18 19:43:23 xb /kernel: arp: 202.79.180.1 moved from 00:04:5a:49:eb:74 > to 00:50:0f:4f:c0:00 on rl0 > Jan 18 19:45:06 xb /kernel: arp: 202.79.180.1 moved from 00:50:0f:4f:c0:00 > to 00:04:5a:49:eb:74 on rl0 > Jan 18 19:45:18 xb /kernel: arp: 202.79.180.1 moved from 00:04:5a:49:eb:74 > to 00:50:0f:4f:c0:00 on rl0 > Jan 18 19:45:41 xb /kernel: arp: 202.79.180.1 moved from 00:50:0f:4f:c0:00 > to 00:04:5a:49:eb:74 on rl0 > Jan 18 19:45:45 xb /kernel: arp: 202.79.180.1 moved from 00:04:5a:49:eb:74 > to 00:50:0f:4f:c0:00 on rl0 looks like someone is using tools like ettercap. airot
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20040118153512.GA23872>