From owner-freebsd-questions Thu Jul 26 12:23:55 2001 Delivered-To: freebsd-questions@freebsd.org Received: from hotmail.com (f213.pav2.hotmail.com [64.4.37.213]) by hub.freebsd.org (Postfix) with ESMTP id ACD1A37B403 for ; Thu, 26 Jul 2001 12:23:52 -0700 (PDT) (envelope-from jdtaylor451@hotmail.com) Received: from mail pickup service by hotmail.com with Microsoft SMTPSVC; Thu, 26 Jul 2001 12:23:52 -0700 Received: from 64.245.235.242 by pv2fd.pav2.hotmail.msn.com with HTTP; Thu, 26 Jul 2001 19:23:52 GMT X-Originating-IP: [64.245.235.242] From: "john taylor" To: freebsd-questions@freebsd.org Subject: ARP flipping address? Date: Thu, 26 Jul 2001 14:23:52 -0500 Mime-Version: 1.0 Content-Type: text/plain; format=flowed Message-ID: X-OriginalArrivalTime: 26 Jul 2001 19:23:52.0654 (UTC) FILETIME=[81379EE0:01C11608] Sender: owner-freebsd-questions@FreeBSD.ORG Precedence: bulk List-ID: List-Archive: (Web Archive) List-Help: (List Instructions) List-Subscribe: List-Unsubscribe: X-Loop: FreeBSD.ORG I have a Sonicwall XPRS firewall with a DMZ port that controls DoS attacks on our publicly addressable servers. The server is a FreeBSD 4.3-Release machine with a single NIC with a static, public IP running ProFTPd, Apache, SSH, Postfix. Due to the circumstance of when I first began noticing the flip I had thought that afpd (Mac file sharing over TCP) might be involved in the problem, but I have since rebuilt the machine without afpd, netatalk, and samba and the problem persists. I know that this issue is more than likely due to the configuration of the firewall, but hoped that someone here may recognize something with regard to FreeBSD in the problem. Alert shown from dmesg... arp: AAA.AAA.AAA.AAA moved from YY:YY:YY:YY:YY:YY to ZZ:ZZ:ZZ:ZZ:ZZ:ZZ on ep0 arp: ZZ:ZZ:ZZ:ZZ:ZZ:ZZ is using my IP address BBB.BBB.BBB.BBB! where... - BBB.BBB.BBB.BBB is the correct IP of the server's NIC - AAA.AAA.AAA.AAA is the public IP for the LAN - YY.YY.YY.YY.YY.YY is believed to be the MAC for the T1 router (Vina) - ZZ.ZZ.ZZ.ZZ.ZZ.ZZ is the MAC address of the Sonicwall firewall device Any ideas? TIA. John Taylor _________________________________________________________________ Get your FREE download of MSN Explorer at http://explorer.msn.com/intl.asp To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-questions" in the body of the message