[ previous ] [ next ] [ threads ]
 From:  "Simon Dick" <simond at irrelevant dot org>
 To:  <cbuechler at gmail dot com>, <dempseyb at davishealthsystem dot org>
 Cc:  <m0n0wall at lists dot m0n0 dot ch>
 Subject:  Re: [m0n0wall] Question Concerning logs
 Date:  Thu, 3 Mar 2005 23:44:15 -0000
I find that normally happens when both interfaces are on the same bit of ethernet

-----Original Message-----
    From: "Chris Buechler"<cbuechler at gmail dot com>
    Sent: 03/03/05 21:08:40
    To: "Bill Dempsey"<dempseyb at davishealthsystem dot org>
    Cc: "m0n0wall at lists dot m0n0 dot ch"<m0n0wall at lists dot m0n0 dot ch>
    Subject: Re: [m0n0wall] Question Concerning logs
    On Thu, 3 Mar 2005 08:26:01 -0500, Bill Dempsey
    <dempseyb at davishealthsystem dot org> wrote:
    > I'm logging the following in the system log of M0n0wall.
    > The IP in question is a RedHat linux box.
    > My Question is, what causes this - I assume it's probably a problem with
    > multiple nics in the box.  Any one know how to fix it?
    > Mar 3 08:01:21   /kernel: arp: moved from 00:0f:1f:6a:01:c3
    > to 00:04:23:ab:81:44 on xl1
    > Mar 3 08:01:21   /kernel: arp: moved from 00:04:23:ab:81:44
    > to 00:0f:1f:6a:01:c3 on xl1
    That log indicates exactly what it shows.  The RH box is using
    alternating NIC's to access the internet for some reason.  BSD logs
    ARP changes like that because it can be a sign of ARP mischief.
    Possibly some sort of failover on the same IP between the two NIC's? 
    I've seen messages like that in various failover setups that aren't
    operating properly (or are failing over for legit reasons).
    A forum/list with more Red Hat knowledge available might provide more
    helpful info than we can on this one.
    To unsubscribe, e-mail: m0n0wall dash unsubscribe at lists dot m0n0 dot ch
    For additional commands, e-mail: m0n0wall dash help at lists dot m0n0 dot ch