Skip site navigation (1)Skip section navigation (2)
Date:      Sun, 23 Apr 2000 18:49:05 -0400
From:      "Crist J. Clark" <cjc@cc942873-a.ewndsr1.nj.home.com>
To:        Dan Larsson <dl@tyfon.net>
Cc:        "'miy'" <miyako@sakr.net>, freebsd-questions@FreeBSD.ORG
Subject:   Re: network replies causing system messages flooding
Message-ID:  <20000423184904.F70371@cc942873-a.ewndsr1.nj.home.com>
In-Reply-To: <000801bfad5b$dea8d920$1401a8c0@intranet.tyfon.net>; from dl@tyfon.net on Sun, Apr 23, 2000 at 09:41:07PM %2B0200
References:  <Pine.BSF.4.10.10004231516090.474-100000@sakr.net> <000801bfad5b$dea8d920$1401a8c0@intranet.tyfon.net>

next in thread | previous in thread | raw e-mail | index | archive | help
On Sun, Apr 23, 2000 at 09:41:07PM +0200, Dan Larsson wrote:
> | -----Original Message-----
> | From: owner-freebsd-questions@FreeBSD.ORG
> | [mailto:owner-freebsd-questions@FreeBSD.ORG]On Behalf Of miy
> | Sent: Sunday, April 23, 2000 9:18 PM
> | To: cjclark@home.com
> | Cc: freebsd-questions@FreeBSD.ORG
> | Subject: Re: network replies causing system messages flooding
> | 
> | 
> | 
> | My system messages are still being flooded by the following message:
> | 
> | arp: 10.0.0.4 is on ed1 but got reply from 00:80:c8:e8:ea:d7 on rl0
> | arp: 10.0.0.4 is on ed1 but got reply from 00:80:c8:e8:ea:d7 on rl0
> | 
> | while I try and solve this problem, is there any way I can filter 
> | them from system logging?
> 
> The options you're looking for are in /etc/syslog.conf. Check line
> which ends with /dev/console.
> 
> For further info: man syslog.conf

The problem with trying to stop these at syslogd(8) is that these are
kernel messages being generated at the LOG_ERR level. I really would
not want to toss them out at the expense of losing other messages at
that level. Now, you can run the syslogd output through some type of
filtering program, but that would be a whole other problem with plenty
of gotchas of its own.

The code that generates these messages is in
/usr/src/sys/netinet/if_ether.c,

                if (rt->rt_ifp != &ac->ac_if) {
                        log(LOG_ERR, "arp: %s is on %s%d but got reply from %6D on %s%d\n",
                            inet_ntoa(isaddr),
                            rt->rt_ifp->if_name, rt->rt_ifp->if_unit,
                            ea->arp_sha, ":",
                            ac->ac_if.if_name, ac->ac_if.if_unit);
                        goto reply;
                }

Now, before anyone uses this patch: I AM NOT A KERNEL HACKER. I DO NOT
KNOW WHAT THE HELL I AM DOING. But the following patch should turn off
those messages if you set,

option		ARP_IGNORE_WRONG_IF

In your kernel configuration file.

--- if_ether.c  Fri Oct 22 04:02:33 1999
+++ if_ether.c  Sun Apr 23 18:45:17 2000
@@ -539,11 +539,13 @@
        if (la && (rt = la->la_rt) && (sdl = SDL(rt->rt_gateway))) {
 #ifndef BRIDGE /* the following is not an error when doing bridging */
                if (rt->rt_ifp != &ac->ac_if) {
+#ifndef ARP_IGNORE_WRONG_IF /* do not log the packet -- NOT RECOMMENDED */
                        log(LOG_ERR, "arp: %s is on %s%d but got reply from %6D on %s%d\n",
                            inet_ntoa(isaddr),
                            rt->rt_ifp->if_name, rt->rt_ifp->if_unit,
                            ea->arp_sha, ":",
                            ac->ac_if.if_name, ac->ac_if.if_unit);
+#endif
                        goto reply;
                }
 #endif



-- 
Crist J. Clark                           cjclark@home.com


To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-questions" in the body of the message




Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20000423184904.F70371>