[ previous ] [ next ] [ threads ]
 
 From:  "Lee Sharp" <leesharp at hal dash pc dot org>
 To:  <m0n0wall at lists dot m0n0 dot ch>
 Subject:  Re: [m0n0wall] Trouble with unknown arplookup
 Date:  Mon, 9 Oct 2006 10:17:26 -0500
From: "Ethan S." <dragon788 at gmail dot com>

> Oct 9 09:26:57 m0n0wall /kernel: arplookup 10.1.1.1 failed: host is not on
> local network
> Oct 9 09:27:37 m0n0wall last message repeated 2 times
> Oct 9 09:29:37 m0n0wall last message repeated 6 times
> Oct 9 09:39:37 m0n0wall last message repeated 30 times
> Oct 9 09:49:37 m0n0wall last message repeated 30 times

> I keep seeing this over and over in my logs. Would this have anything to 
> do
> with DHCP from my ISP? The IP I get isn't in the private range and I use a
> 192.168 range on my internal network, I really can't figure out where this
> arp is coming from but it usually occurs after the router makes a DHCP
> request and gets an ack back.

Someone with a 10.1.1.1 IP address is on your LAN trying to get out. 
Usually a vendor or consultant with a hard coded IP address.

                                Lee