Re: arp messages: Why is this happening?
* Mark Atkinson [EMAIL PROTECTED] [20030613 19:00]: wrote: This is probably a DHCP network? This would happen if a client gets a new DHCP assigned IP address, instead of it's old one, and before the freebsd boxes' ARP cache expired for that machine. Usually this only happens with: Not a DHCP network per se, but an ISP environment where clients get assigned dynamic IPs on dialup. However, this problem was never so pronounced when I was running 4.7-STABLE, only after 4.8-STABLE. - broken DHCP clients (not requesting it's old ip back upon reboot). - broken DHCP servers (not maintaining lease state properly to assign clients their old addresses) - tight DHCP address spaces (ie. the DHCP server must reuse previously leased IP addresses to accomodate new DISCOVERS). or a combination of the above. No idea if that applies to me, but we do not run a DHCP server. Either that or you have a whole bunch of machines that use gratuitous ARP to advertise the new interfaces in a failover situation. Yikes! I need to be a network specialist, sort of.. but no. -Wash -- Odhiambo Washington [EMAIL PROTECTED] The box said 'Requires Wananchi Online Ltd. www.wananchi.com Windows 95, NT, or better,' Tel: +254 2 313985-9 +254 2 313922 so I installed FreeBSD. GSM: +254 72 743223 +254 733 744121 This sig is McQ! :-) For three days after death hair and fingernails continue to grow but phone calls taper off. -- Johnny Carson ___ [EMAIL PROTECTED] mailing list http://lists.freebsd.org/mailman/listinfo/freebsd-questions To unsubscribe, send any mail to [EMAIL PROTECTED]
Re: arp messages: Why is this happening?
* Dan Nelson [EMAIL PROTECTED] [20030613 18:40]: wrote: In the last episode (Jun 13), ODHIAMBO Washington said: My log files (and console) fill up with these messages. arp: 62.8.64.172 moved from 00:c0:05:11:01:f1 to 00:c0:05:10:01:f1 on bge1 arp: 62.8.64.201 moved from 00:c0:05:10:01:f1 to 00:c0:05:11:01:f1 on bge1 arp: 62.8.64.201 moved from 00:c0:05:11:01:f1 to 00:c0:05:10:01:f1 on bge1 arp: 62.8.64.145 moved from 00:c0:05:11:01:f1 to 00:c0:05:10:01:f1 on bge1 arp: 62.8.64.212 moved from 00:c0:05:11:01:f1 to 00:c0:05:10:01:f1 on bge1 arp: 62.8.64.188 moved from 00:c0:05:11:01:f1 to 00:c0:05:10:01:f1 on bge1 ... What are the machines at those two mac addresses? Are they maybe clustered servers, and during failover, you see an arp line for each ip that gets moved from one to the other Now that points me towards some clue ... those mac addresses are not even on the box where I am seeing these messages. I can see the mac addresses by using ifconfig, yes?? So some machines, possibly routers, are doing this... Best regards, Odhiambo Washington Wananchi Online Ltd. ___W_A_N_A_N_C_H_I__O_N_L_I_N_E__L_T_D___The People's Choice__ Wananchi Head Office|*| Tel: +254 2 313 985-9 1st Flr Loita, Loita St.|*| Fax: +254 2 313 922 10286-GPO, NAIROBI, KE |*| e-mail: wash at wananchi dot com -- ++ ...with a colour temperature of 9300K using barco phosphors and connected to an AGP Matrox G200 via 5 individual RG179B/U coax cables with a contact resistance less than 0.1 mOhm... -- David Jordan ___ [EMAIL PROTECTED] mailing list http://lists.freebsd.org/mailman/listinfo/freebsd-questions To unsubscribe, send any mail to [EMAIL PROTECTED]
Re: arp messages: Why is this happening?
* Bill Moran [EMAIL PROTECTED] [20030613 18:36]: wrote: ODHIAMBO Washington wrote: My log files (and console) fill up with these messages. arp: 62.8.64.172 moved from 00:c0:05:11:01:f1 to 00:c0:05:10:01:f1 on bge1 arp: 62.8.64.201 moved from 00:c0:05:10:01:f1 to 00:c0:05:11:01:f1 on bge1 arp: 62.8.64.201 moved from 00:c0:05:11:01:f1 to 00:c0:05:10:01:f1 on bge1 arp: 62.8.64.145 moved from 00:c0:05:11:01:f1 to 00:c0:05:10:01:f1 on bge1 arp: 62.8.64.212 moved from 00:c0:05:11:01:f1 to 00:c0:05:10:01:f1 on bge1 arp: 62.8.64.188 moved from 00:c0:05:11:01:f1 to 00:c0:05:10:01:f1 on bge1 Could be that you're on a DHCP network and addresses are moving around a lot. An ISP env, without a DHCP server, but with a NAS assigning IPs to dialup clients. I'm on Adelphia cable internet, and I see these messages off and on. Especially after network problems, there'll be a long list of them. ..a long list of them is also what I see here. I just shortened what I sent. Occassionally, I'll see one MAC address that is generating a lot of these messages ... I assume it's some broken Windows machine that can't figure out what IP to use. There is a sysctl that will turn off reporting of this: net.link.ether.inet.log_arp_movements Set it to 0 to stop the logging. Thanks. I was looking for something like this, but is this really available in 4.8-STABLE Best regards, Odhiambo Washington Wananchi Online Ltd. ___W_A_N_A_N_C_H_I__O_N_L_I_N_E__L_T_D___The People's Choice__ Wananchi Head Office|*| Tel: +254 2 313 985-9 1st Flr Loita, Loita St.|*| Fax: +254 2 313 922 10286-GPO, NAIROBI, KE |*| e-mail: wash at wananchi dot com -- ++ When you say 'I wrote a program that crashed Windows', people just stare at you blankly and say 'Hey, I got those with the system, for free' Linus Torvalds ___ [EMAIL PROTECTED] mailing list http://lists.freebsd.org/mailman/listinfo/freebsd-questions To unsubscribe, send any mail to [EMAIL PROTECTED]
Re: arp messages: Why is this happening?
ODHIAMBO Washington wrote: * Bill Moran [EMAIL PROTECTED] [20030613 18:36]: wrote: ODHIAMBO Washington wrote: My log files (and console) fill up with these messages. arp: 62.8.64.172 moved from 00:c0:05:11:01:f1 to 00:c0:05:10:01:f1 on bge1 arp: 62.8.64.201 moved from 00:c0:05:10:01:f1 to 00:c0:05:11:01:f1 on bge1 arp: 62.8.64.201 moved from 00:c0:05:11:01:f1 to 00:c0:05:10:01:f1 on bge1 arp: 62.8.64.145 moved from 00:c0:05:11:01:f1 to 00:c0:05:10:01:f1 on bge1 arp: 62.8.64.212 moved from 00:c0:05:11:01:f1 to 00:c0:05:10:01:f1 on bge1 arp: 62.8.64.188 moved from 00:c0:05:11:01:f1 to 00:c0:05:10:01:f1 on bge1 Could be that you're on a DHCP network and addresses are moving around a lot. An ISP env, without a DHCP server, but with a NAS assigning IPs to dialup clients. For all intents and purposes, that's the same as a DHCP server in it's affect on arp. 'netstat -rn' should give you IPs and MAC addresses. You could monitor that to get an idea of what the IPs are doing and possibly improve the configuration of the NAS to reduce the problem. There is a sysctl that will turn off reporting of this: net.link.ether.inet.log_arp_movements Set it to 0 to stop the logging. Thanks. I was looking for something like this, but is this really available in 4.8-STABLE It's available earlier than that. I don't know exactly when it was added, but it's definately in 4.8. If you're the ISP, you may want to consider researching the problem before you blindly turn this off. Although you could turn the messages off, put it on your list of things to do, and turn them back on in a month or whatever when you had more time to research the problem. -- Bill Moran Potential Technologies http://www.potentialtech.com ___ [EMAIL PROTECTED] mailing list http://lists.freebsd.org/mailman/listinfo/freebsd-questions To unsubscribe, send any mail to [EMAIL PROTECTED]
Re: arp messages: Why is this happening?
In the last episode (Jun 14), ODHIAMBO Washington said: * Dan Nelson [EMAIL PROTECTED] [20030613 18:40]: wrote: In the last episode (Jun 13), ODHIAMBO Washington said: My log files (and console) fill up with these messages. arp: 62.8.64.172 moved from 00:c0:05:11:01:f1 to 00:c0:05:10:01:f1 on bge1 arp: 62.8.64.201 moved from 00:c0:05:10:01:f1 to 00:c0:05:11:01:f1 on bge1 arp: 62.8.64.201 moved from 00:c0:05:11:01:f1 to 00:c0:05:10:01:f1 on bge1 arp: 62.8.64.145 moved from 00:c0:05:11:01:f1 to 00:c0:05:10:01:f1 on bge1 arp: 62.8.64.212 moved from 00:c0:05:11:01:f1 to 00:c0:05:10:01:f1 on bge1 arp: 62.8.64.188 moved from 00:c0:05:11:01:f1 to 00:c0:05:10:01:f1 on bge1 ... What are the machines at those two mac addresses? Are they maybe clustered servers, and during failover, you see an arp line for each ip that gets moved from one to the other Now that points me towards some clue ... those mac addresses are not even on the box where I am seeing these messages. I can see the mac addresses by using ifconfig, yes?? So some machines, possibly routers, are doing this... Maybe. Routers shouldn't cause this because they only deal with packets not in your subnet. The kernel only keeps MAC addresses for IPs in your subnet. Your kernel is complaining that incoming packets that were coming in with an IP of 62.8.64.188 and a MAC address of 00:c0:05:11:01:f1 are now arriving with a MAC address of 00:c0:05:10:01:f1. This could mean that two active phyical machines are configured with the same IP address (i.e. an IP conflict), two physical machines alternate using that IP (i.e. failover clustering), or that your ifconfig netmask is too large and the kernel is remembering MAC addresses for IPs that it should really be forwaring to a router instead. You can use the arp -a or netstat -r commands to display the IP-MAC mappings the kernel knows about. -- Dan Nelson [EMAIL PROTECTED] ___ [EMAIL PROTECTED] mailing list http://lists.freebsd.org/mailman/listinfo/freebsd-questions To unsubscribe, send any mail to [EMAIL PROTECTED]
arp messages: Why is this happening?
My log files (and console) fill up with these messages. arp: 62.8.64.172 moved from 00:c0:05:11:01:f1 to 00:c0:05:10:01:f1 on bge1 arp: 62.8.64.201 moved from 00:c0:05:10:01:f1 to 00:c0:05:11:01:f1 on bge1 arp: 62.8.64.201 moved from 00:c0:05:11:01:f1 to 00:c0:05:10:01:f1 on bge1 arp: 62.8.64.145 moved from 00:c0:05:11:01:f1 to 00:c0:05:10:01:f1 on bge1 arp: 62.8.64.212 moved from 00:c0:05:11:01:f1 to 00:c0:05:10:01:f1 on bge1 arp: 62.8.64.188 moved from 00:c0:05:11:01:f1 to 00:c0:05:10:01:f1 on bge1 ... Googling doesn't seem to give me a good answer as to why. This is 4.8-STABLE -Wash -- Odhiambo Washington [EMAIL PROTECTED] The box said 'Requires Wananchi Online Ltd. www.wananchi.com Windows 95, NT, or better,' Tel: +254 2 313985-9 +254 2 313922 so I installed FreeBSD. GSM: +254 72 743223 +254 733 744121 This sig is McQ! :-) OK, so you're a Ph.D. Just don't touch anything. ___ [EMAIL PROTECTED] mailing list http://lists.freebsd.org/mailman/listinfo/freebsd-questions To unsubscribe, send any mail to [EMAIL PROTECTED]
Re: arp messages: Why is this happening?
ODHIAMBO Washington wrote: My log files (and console) fill up with these messages. arp: 62.8.64.172 moved from 00:c0:05:11:01:f1 to 00:c0:05:10:01:f1 on bge1 arp: 62.8.64.201 moved from 00:c0:05:10:01:f1 to 00:c0:05:11:01:f1 on bge1 arp: 62.8.64.201 moved from 00:c0:05:11:01:f1 to 00:c0:05:10:01:f1 on bge1 arp: 62.8.64.145 moved from 00:c0:05:11:01:f1 to 00:c0:05:10:01:f1 on bge1 arp: 62.8.64.212 moved from 00:c0:05:11:01:f1 to 00:c0:05:10:01:f1 on bge1 arp: 62.8.64.188 moved from 00:c0:05:11:01:f1 to 00:c0:05:10:01:f1 on bge1 Could be that you're on a DHCP network and addresses are moving around a lot. I'm on Adelphia cable internet, and I see these messages off and on. Especially after network problems, there'll be a long list of them. Occassionally, I'll see one MAC address that is generating a lot of these messages ... I assume it's some broken Windows machine that can't figure out what IP to use. There is a sysctl that will turn off reporting of this: net.link.ether.inet.log_arp_movements Set it to 0 to stop the logging. -- Bill Moran Potential Technologies http://www.potentialtech.com ___ [EMAIL PROTECTED] mailing list http://lists.freebsd.org/mailman/listinfo/freebsd-questions To unsubscribe, send any mail to [EMAIL PROTECTED]
Re: arp messages: Why is this happening?
In the last episode (Jun 13), ODHIAMBO Washington said: My log files (and console) fill up with these messages. arp: 62.8.64.172 moved from 00:c0:05:11:01:f1 to 00:c0:05:10:01:f1 on bge1 arp: 62.8.64.201 moved from 00:c0:05:10:01:f1 to 00:c0:05:11:01:f1 on bge1 arp: 62.8.64.201 moved from 00:c0:05:11:01:f1 to 00:c0:05:10:01:f1 on bge1 arp: 62.8.64.145 moved from 00:c0:05:11:01:f1 to 00:c0:05:10:01:f1 on bge1 arp: 62.8.64.212 moved from 00:c0:05:11:01:f1 to 00:c0:05:10:01:f1 on bge1 arp: 62.8.64.188 moved from 00:c0:05:11:01:f1 to 00:c0:05:10:01:f1 on bge1 ... What are the machines at those two mac addresses? Are they maybe clustered servers, and during failover, you see an arp line for each ip that gets moved from one to the other? -- Dan Nelson [EMAIL PROTECTED] ___ [EMAIL PROTECTED] mailing list http://lists.freebsd.org/mailman/listinfo/freebsd-questions To unsubscribe, send any mail to [EMAIL PROTECTED]
Re: arp messages: Why is this happening?
This is probably a DHCP network? This would happen if a client gets a new DHCP assigned IP address, instead of it's old one, and before the freebsd boxes' ARP cache expired for that machine. Usually this only happens with: - broken DHCP clients (not requesting it's old ip back upon reboot). - broken DHCP servers (not maintaining lease state properly to assign clients their old addresses) - tight DHCP address spaces (ie. the DHCP server must reuse previously leased IP addresses to accomodate new DISCOVERS). or a combination of the above. Either that or you have a whole bunch of machines that use gratuitous ARP to advertise the new interfaces in a failover situation. ODHIAMBO Washington wrote: My log files (and console) fill up with these messages. arp: 62.8.64.172 moved from 00:c0:05:11:01:f1 to 00:c0:05:10:01:f1 on bge1 arp: 62.8.64.201 moved from 00:c0:05:10:01:f1 to 00:c0:05:11:01:f1 on bge1 arp: 62.8.64.201 moved from 00:c0:05:11:01:f1 to 00:c0:05:10:01:f1 on bge1 arp: 62.8.64.145 moved from 00:c0:05:11:01:f1 to 00:c0:05:10:01:f1 on bge1 arp: 62.8.64.212 moved from 00:c0:05:11:01:f1 to 00:c0:05:10:01:f1 on bge1 arp: 62.8.64.188 moved from 00:c0:05:11:01:f1 to 00:c0:05:10:01:f1 on bge1 ... Googling doesn't seem to give me a good answer as to why. This is 4.8-STABLE -Wash --- Mark atkin901 at NOSPAM yahoo dot com (!wired)?(coffee++):(wired); ___ [EMAIL PROTECTED] mailing list http://lists.freebsd.org/mailman/listinfo/freebsd-questions To unsubscribe, send any mail to [EMAIL PROTECTED]
