Date: Wed, 6 Jun 2001 17:29:47 -0700 From: "Philip J. Koenig" <pjklist@ekahuna.com> To: questions@FreeBSD.ORG Subject: Re: "Unknown hardware address format" Message-ID: <3B1E688B.26258.D842CF@localhost> In-Reply-To: <17c59317ef57.17ef5717c593@bowdoin.edu>
next in thread | previous in thread | raw e-mail | index | archive | help
Very interesting.. well take a look at these archived messages. I'd love to capture the packets too but they happen so rarely here I might have to capture tons of stuff: http://docs.freebsd.org/cgi/getmsg.cgi?fetch=1844097+0+archive/2000/freebsd-questions/20000806.freebsd-questions http://docs.freebsd.org/cgi/getmsg.cgi?fetch=1866032+0+archive/2000/freebsd-questions/20000806.freebsd-questions (it's a pity I could only find those messages with an external search engine, the www.freebsd.org archive didn't find them) Phil On 6 Jun 2001, at 17:09, Matthew K. Cowger boldly uttered: > Philip, et. al. > > I get these as well, somedays alot of them, some days not. I am > running in a mixed environment (5+ DEC Alphas, 20+ COmpaq NT Boxes, > Dell Linux Boxes, and a couple macs), And these Unknown Hardware > Address fromat messages endup in my logs on my BSD box all day long > (old Compaq 266 w/ Intel EtherExpress PRo 10/100). I'll be happy to > sent any log output...it would be nice to get rid of these, or find out > what machine is sending them. > > .matt > > ----- Original Message ----- > From: "Philip J. Koenig" <pjklist@ekahuna.com> > Date: Wednesday, June 6, 2001 5:04 pm > Subject: "Unknown hardware address format" > > > I posted a similiar question to this list and the Security list on > > 5/28 and didn't get any definitive replies. > > > > Today I am seeing the same message, out of the blue, in my syslog > > and > > echoed to console (4.3-STABLE): > > > > io /kernel: arp: unknown hardware address format (0x0800) > > > > I searched the mailing list archives to no avail, but ran across > > some > > stuff on altavista, apparently 0800 matches both IP and arp > > protocol > > numbers, here is apparently some kernel code that generates this > > message (if_ether.c), from the URL below: > > > > http://minnie.tuhs.org/FreeBSD- > > srctree/newsrc/netinet/if_ether.c.html > > ----------------- Begin code snippet -------------------- > > if (ntohs(ar->ar_hrd) != ARPHRD_ETHER > > && ntohs(ar->ar_hrd) != ARPHRD_IEEE802) { > > log(LOG_ERR, > > "arp: unknown hardware address format (0x%2D)\n", > > (unsigned char *)&ar->ar_hrd, ""); > > m_freem(m); > > continue; > > } > > --------------------- End code snippet ------------------ > > > > > > I keep worrying it may be a security breach or something, or maybe > > a > > piece of failing network hardware. I'd rather not join one of the > > kernel lists just to ask this question, so if anyone is a > > kernel/net > > hacker or would like to forward it to one, i'd appreciate it.. -- Philip J. Koenig pjklist@ekahuna.com Electric Kahuna Systems -- Computers & Communications for the New Millenium To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-questions" in the body of the message
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?3B1E688B.26258.D842CF>