Christer Solskogen wrote:
[EMAIL PROTECTED] ~]# tcpdump -vvv -n -l -e arp
tcpdump: listening on nfe0, link-type EN10MB (Ethernet), capture size 96
bytes
08:58:46.337968 00:1d:60:36:34:a6 > ff:ff:ff:ff:ff:ff, ethertype ARP
(0x0806), length 60: arp who-has 192.168.0.3 tell 192.168.0.12
08:58:46.
Christian Walther wrote:
I don't want to point you into the wrong direction, but is it possible
that this arp entry is actually a sign of an ARP spoofing attempt?
http://en.wikipedia.org/wiki/ARP_spoofing
I suspect that, but I just want to know if might be something else.
Do you run a wirel
Jon Radel wrote:
to see what you can catch.
First of all, thanks for taking time to help me on this.
[EMAIL PROTECTED] ~]# tcpdump -vvv -n -l -e arp
tcpdump: listening on nfe0, link-type EN10MB (Ethernet), capture size 96
bytes
08:58:46.337968 00:1d:60:36:34:a6 > ff:ff:ff:ff:ff:ff, ethertyp
At 04:50 PM 5/14/2008, Christer Solskogen wrote:
Derek Ragona wrote:
I would do a traceroute from all your hosts there. When you do keep an
eye out for the arp error message. This should help find the host
causing these errors and then look at that systems configuration.
Also do you have mor
Jon Radel wrote:
Christer Solskogen wrote:
Derek Ragona wrote:
I would do a traceroute from all your hosts there. When you do keep
an eye out for the arp error message. This should help find the host
causing these errors and then look at that systems configuration.
Also do you have more
Christer Solskogen wrote:
Derek Ragona wrote:
I would do a traceroute from all your hosts there. When you do keep
an eye out for the arp error message. This should help find the host
causing these errors and then look at that systems configuration.
Also do you have more than one ethernet
Derek Ragona wrote:
I would do a traceroute from all your hosts there. When you do keep an
eye out for the arp error message. This should help find the host
causing these errors and then look at that systems configuration.
Also do you have more than one ethernet interface in the system show
At 06:22 AM 5/14/2008, Christer Solskogen wrote:
Derek Ragona wrote:
Yes aliases should have a netmask of 255.255.255.255
Still no go.
192.168.0.255 is showing up in "arp -a" and netstat -rn. (and the
"arplookup 0.0.0.0 failed: host is not on local network" in /var/log/messages)
nfe0: flag
Derek Ragona wrote:
Yes aliases should have a netmask of 255.255.255.255
Still no go.
192.168.0.255 is showing up in "arp -a" and netstat -rn. (and the
"arplookup 0.0.0.0 failed: host is not on local network" in
/var/log/messages)
nfe0: flags=8843 metric 0 mtu 1500
options=18b
At 03:44 PM 5/12/2008, Christer Solskogen wrote:
Derek Ragona wrote:
You may want to do traceroutes from the systems that do find the 0.0.0.0
interface. I would bet you have a default route and/or netmask sending
the traffic. You will get those arp messages if you run two different
interfac
Derek Ragona wrote:
You may want to do traceroutes from the systems that do find the 0.0.0.0
interface. I would bet you have a default route and/or netmask sending
the traffic. You will get those arp messages if you run two different
interfaces on the same system, on the same subnet (not to
At 12:55 PM 5/12/2008, Christer Solskogen wrote:
Christer Solskogen wrote:
Derek Ragona wrote:
Sounds like you have 0.0.0.0 configured on an ethernet interface. I
would check all your systems, and be sure it isn't used.
I checked, and there is no interface with that ip address. But thanks fo
Christer Solskogen wrote:
Derek Ragona wrote:
Sounds like you have 0.0.0.0 configured on an ethernet interface. I
would check all your systems, and be sure it isn't used.
I checked, and there is no interface with that ip address. But thanks
for the advice.
OpenBSD box - where 0.0.0.0 i
Derek Ragona wrote:
Sounds like you have 0.0.0.0 configured on an ethernet interface. I
would check all your systems, and be sure it isn't used.
I checked, and there is no interface with that ip address. But thanks
for the advice.
OpenBSD box - where 0.0.0.0 is resolving to.
rl0: flags=
At 03:39 PM 5/11/2008, Christer Solskogen wrote:
Hi!
I have been seeing a lot of warnings in syslog the last week. Do anyone
have a tip for where to begin searching for the sinner?
arplookup 0.0.0.0 failed: host is not on local network
arplookup 0.0.0.0 failed: host is not on local network
ar
15 matches
Mail list logo
