From owner-freebsd-security  Thu Nov 15 13:50:51 2001
Delivered-To: freebsd-security@freebsd.org
Received: from lazir.toya.net.pl (lazir.toya.net.pl [217.113.224.3])
	by hub.freebsd.org (Postfix) with SMTP id 899F837B405
	for <security@FreeBSD.ORG>; Thu, 15 Nov 2001 13:50:46 -0800 (PST)
Received: (qmail 7519 invoked by uid 791); 15 Nov 2001 21:48:21 -0000
Received: from localhost (sendmail-bs@127.0.0.1)
  by localhost with SMTP; 15 Nov 2001 21:48:21 -0000
Date: Thu, 15 Nov 2001 22:48:21 +0100 (CET)
From: <airot@lazir.toya.net.pl>
To: Sven Wittig <Sven.wittig@gmx.de>
Cc: <security@FreeBSD.ORG>
Subject: Re: unusual  log in var/log/messages 
In-Reply-To: <3BF4369A.3030503@gmx.de>
Message-ID: <Pine.LNX.4.33.0111152242230.4419-100000@lazir.toya.net.pl>
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
Sender: owner-freebsd-security@FreeBSD.ORG
Precedence: bulk
List-ID: <freebsd-security.FreeBSD.ORG>
List-Archive: <http://docs.freebsd.org/mail/> (Web Archive)
List-Help: <mailto:majordomo@FreeBSD.ORG?subject=help> (List Instructions)
List-Subscribe: <mailto:majordomo@FreeBSD.ORG?subject=subscribe%20freebsd-security>
List-Unsubscribe: <mailto:majordomo@FreeBSD.ORG?subject=unsubscribe%20freebsd-security>
X-Loop: FreeBSD.org



On Thu, 15 Nov 2001, Sven Wittig wrote:

> Hi,
>
> I recently discovered this entry in my messages-logfile
>
> " Nov 14 15:10:44 leo2 /kernel: arp: 137.226.141.33 moved from
> 00:40:33:39:80:d1 to 00:50:bf:7e:6e:70 on de0"
>
> is this a kind of attack or what?
>

Nope it only mean that someone changed arp.
It could be spoof, or simply someone changed network card.

Regards.

airot...


To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-security" in the body of the message