Christer Solskogen wrote:
[EMAIL PROTECTED] ~]# tcpdump -vvv -n -l -e arp
tcpdump: listening on nfe0, link-type EN10MB (Ethernet), capture size 96
bytes
08:58:46.337968 00:1d:60:36:34:a6 > ff:ff:ff:ff:ff:ff, ethertype ARP
(0x0806), length 60: arp who-has 192.168.0.3 tell 192.168.0.12
08:58:46.
Christian Walther wrote:
I don't want to point you into the wrong direction, but is it possible
that this arp entry is actually a sign of an ARP spoofing attempt?
http://en.wikipedia.org/wiki/ARP_spoofing
I suspect that, but I just want to know if might be something else.
Do you run a wirel
Jon Radel wrote:
to see what you can catch.
First of all, thanks for taking time to help me on this.
[EMAIL PROTECTED] ~]# tcpdump -vvv -n -l -e arp
tcpdump: listening on nfe0, link-type EN10MB (Ethernet), capture size 96
bytes
08:58:46.337968 00:1d:60:36:34:a6 > ff:ff:ff:ff:ff:ff, ethertyp
At 04:50 PM 5/14/2008, Christer Solskogen wrote:
Derek Ragona wrote:
I would do a traceroute from all your hosts there. When you do keep an
eye out for the arp error message. This should help find the host
causing these errors and then look at that systems configuration.
Also do you have mor
020 00:16:76:cf:e4:b3 > 00:08:02:cc:b1:60, ethertype ARP
(0x0806), length 42: arp reply 216.143.151.11 is-at 00:16:76:cf:e4:b3
with resulting message in debug.log:
May 14 22:45:06 left kernel: arplookup 0.0.0.0 failed: host is not on
local netw
ork
May 14 22:45:07 left last message repeated
Christer Solskogen wrote:
Derek Ragona wrote:
I would do a traceroute from all your hosts there. When you do keep
an eye out for the arp error message. This should help find the host
causing these errors and then look at that systems configuration.
Also do you have more than one ethernet
Derek Ragona wrote:
I would do a traceroute from all your hosts there. When you do keep an
eye out for the arp error message. This should help find the host
causing these errors and then look at that systems configuration.
Also do you have more than one ethernet interface in the system show
At 06:22 AM 5/14/2008, Christer Solskogen wrote:
Derek Ragona wrote:
Yes aliases should have a netmask of 255.255.255.255
Still no go.
192.168.0.255 is showing up in "arp -a" and netstat -rn. (and the
"arplookup 0.0.0.0 failed: host is not on local network" in /var/
Derek Ragona wrote:
Yes aliases should have a netmask of 255.255.255.255
Still no go.
192.168.0.255 is showing up in "arp -a" and netstat -rn. (and the
"arplookup 0.0.0.0 failed: host is not on local network" in
/var/log/messages)
nfe0: flags=8843 metric 0 mtu 1500
At 03:44 PM 5/12/2008, Christer Solskogen wrote:
Derek Ragona wrote:
You may want to do traceroutes from the systems that do find the 0.0.0.0
interface. I would bet you have a default route and/or netmask sending
the traffic. You will get those arp messages if you run two different
interfac
Derek Ragona wrote:
You may want to do traceroutes from the systems that do find the 0.0.0.0
interface. I would bet you have a default route and/or netmask sending
the traffic. You will get those arp messages if you run two different
interfaces on the same system, on the same subnet (not to
At 12:55 PM 5/12/2008, Christer Solskogen wrote:
Christer Solskogen wrote:
Derek Ragona wrote:
Sounds like you have 0.0.0.0 configured on an ethernet interface. I
would check all your systems, and be sure it isn't used.
I checked, and there is no interface with that ip address. But thanks fo
Christer Solskogen wrote:
Derek Ragona wrote:
Sounds like you have 0.0.0.0 configured on an ethernet interface. I
would check all your systems, and be sure it isn't used.
I checked, and there is no interface with that ip address. But thanks
for the advice.
OpenBSD box - where 0.0.0.0 i
Derek Ragona wrote:
Sounds like you have 0.0.0.0 configured on an ethernet interface. I
would check all your systems, and be sure it isn't used.
I checked, and there is no interface with that ip address. But thanks
for the advice.
OpenBSD box - where 0.0.0.0 is resolving to.
rl0: flags=
At 03:39 PM 5/11/2008, Christer Solskogen wrote:
Hi!
I have been seeing a lot of warnings in syslog the last week. Do anyone
have a tip for where to begin searching for the sinner?
arplookup 0.0.0.0 failed: host is not on local network
arplookup 0.0.0.0 failed: host is not on local network
Hi!
I have been seeing a lot of warnings in syslog the last week. Do anyone
have a tip for where to begin searching for the sinner?
arplookup 0.0.0.0 failed: host is not on local network
arplookup 0.0.0.0 failed: host is not on local network
arplookup 0.0.0.0 failed: host is not on local
freebsd-questions@freebsd.org
> Subject: No buffer space available arplookup 0.0.0.0 failed:
> host is not
> onload network
>
>
> Hi folks,
> anybody know about the message below?
>
> Abandoning IP Address 200.x.x.x: pinged before offer
> No buffer space available arplook
Hi folks,
anybody know about the message below?
Abandoning IP Address 200.x.x.x: pinged before offer
No buffer space available arplookup 0.0.0.0 failed: host is not on load
network
Fatal trap 12: page fault while in kernel mode fault virtual address = 0x8a
Syncing disks, buffers remaining.1347
# [EMAIL PROTECTED] / 2003-02-04 09:14:17 -0800:
> On Tue, Feb 04, 2003 at 08:15:04AM +0100, Roman Neuhauser wrote:
> > # [EMAIL PROTECTED] / 2003-02-01 18:55:23 -0800:
> > > If you have X installed, you could use ethereal
> > > (/usr/ports/net/ethereal)it is a very nice graphical interface for
On Tue, Feb 04, 2003 at 08:15:04AM +0100, Roman Neuhauser wrote:
> # [EMAIL PROTECTED] / 2003-02-01 18:55:23 -0800:
> > On Sat, Feb 01, 2003 at 05:20:53PM -0500, Stephen D. Kingrea wrote:
> > > tcpdump tells me that incoming smtp requests are generating these
> > > messages at the same time as reci
# [EMAIL PROTECTED] / 2003-02-01 18:55:23 -0800:
> On Sat, Feb 01, 2003 at 05:20:53PM -0500, Stephen D. Kingrea wrote:
> > tcpdump tells me that incoming smtp requests are generating these
> > messages at the same time as recieving mail. i am pretty sure that
> > either sendmail or ipfw rules is th
turns out that the file /etc/mail/local-host-names was not properly
configured.
damn! it is so galling when one misses the simplest things!
stephen
On Sat, 1 Feb 2003, Nathan Kinkade wrote:
>On Sat, Feb 01, 2003 at 05:20:53PM -0500, Stephen D. Kingrea wrote:
>> tcpdump tells me that incoming s
On Sat, Feb 01, 2003 at 05:20:53PM -0500, Stephen D. Kingrea wrote:
> tcpdump tells me that incoming smtp requests are generating these
> messages at the same time as recieving mail. i am pretty sure that
> either sendmail or ipfw rules is the cause...
>
> any good tutorials out there on interpret
;
>To: "Juris Krumins" <[EMAIL PROTECTED]>
>Sent: Friday, January 31, 2003 4:26 PM
>Subject: Re: arplookup 0.0.0.0
>
>
>> is there a way to suppress the message itself? i seem to be getting it
>> quite often, and really just started after configuring an
hope one of youse can help with this...
i am suddenly and inexplicably getting the message:
www /kernel: arpresolve: can't allocate llinfo for 0.0.0.0rt
www /kernel: arplookup 0.0.0.0 failed: host is not on local network
nothing seems affected, that is to say that everything works as
adver
25 matches
Mail list logo
