From owner-freebsd-questions@FreeBSD.ORG Thu Apr 25 02:08:10 2013 Return-Path: Delivered-To: freebsd-questions@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:1900:2254:206a::19:1]) by hub.freebsd.org (Postfix) with ESMTP id 46955323 for ; Thu, 25 Apr 2013 02:08:10 +0000 (UTC) (envelope-from kayasaman@gmail.com) Received: from mail-wi0-x231.google.com (mail-wi0-x231.google.com [IPv6:2a00:1450:400c:c05::231]) by mx1.freebsd.org (Postfix) with ESMTP id D17F9188B for ; Thu, 25 Apr 2013 02:08:09 +0000 (UTC) Received: by mail-wi0-f177.google.com with SMTP id hj19so2773241wib.4 for ; Wed, 24 Apr 2013 19:08:08 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=x-received:message-id:date:from:user-agent:mime-version:to:subject :references:in-reply-to:x-forwarded-message-id:content-type; bh=4NwGbWawcs2ArJRrQbFEz5cb/yeCsGmxIwByqoDz918=; b=uJmHbN3ISj6J5T/8cI/zRB9InObw51xeJiyhiZV9N7fsCpC4hJdGyfxCzkRofvfwnv fbMtr1VNIyUvcDgFj/mZlfm2MDlYaG/8E6q4XtEBKUOq8FKFBS+s2qBeDZTCdB47t1se FHaLUpKg3XM8DMBw+2SZ2yXa6dcO2gurhCeTMrFNeCW1kNi6ZbW9RoaGFVT15UJPEPxx 2qUodSZAPSgqdNGXYb7uUgirWLoDoQd+obonyu1J5+6qZIzbBGaj5hNhn2JXnBxWdNN8 YuBlAP3KmKkYt8iHZvLRBxIRQ3wza8bL/GZNjtsXa+0GC2wCWHu0c4xpPVf3pKbNdyLc wRqA== X-Received: by 10.194.10.129 with SMTP id i1mr57008093wjb.21.1366855688820; Wed, 24 Apr 2013 19:08:08 -0700 (PDT) Received: from X220.optiplex-networks.com (81-178-2-118.dsl.pipex.com. [81.178.2.118]) by mx.google.com with ESMTPSA id q20sm7698568wiv.7.2013.04.24.19.08.07 for (version=TLSv1 cipher=ECDHE-RSA-RC4-SHA bits=128/128); Wed, 24 Apr 2013 19:08:08 -0700 (PDT) Message-ID: <51789007.6090708@gmail.com> Date: Thu, 25 Apr 2013 03:08:07 +0100 From: Kaya Saman User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:17.0) Gecko/20130407 Thunderbird/17.0.5 MIME-Version: 1.0 To: freebsd-questions Subject: Fwd: Unknown IP address shows FreeBSD server MAC in arp cache References: <51788C55.6040009@gmail.com> In-Reply-To: <51788C55.6040009@gmail.com> X-Forwarded-Message-Id: <51788C55.6040009@gmail.com> Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: 7bit X-Content-Filtered-By: Mailman/MimeDel 2.1.14 X-BeenThere: freebsd-questions@freebsd.org X-Mailman-Version: 2.1.14 Precedence: list List-Id: User questions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 25 Apr 2013 02:08:10 -0000 Well.... I managed to find the answer!! Scanning through /etc/defaults/rc.conf I noticed this: dhclient_program="/sbin/dhclient" # Path to dhcp client program. dhclient_flags="" # Extra flags to pass to dhcp client. Then I went back to check my DHCP server's log files and indeed a DHCP request came through from the server even though the IP's are all statically configured on it. Now all I have to do is tell the system not to use the "dhclient" program and then all will be sorted :-) Few..... Regards, Kaya -------- Original Message -------- Subject: Unknown IP address shows FreeBSD server MAC in arp cache Date: Thu, 25 Apr 2013 02:52:21 +0100 From: Kaya Saman To: freebsd-questions@freebsd.org Hi, I'm experiencing a weird problem and I have no idea where to begin with this one! Basically what's happening is that I did a host scan from my NetBSD box running Cacti in order to 'Auto Discover' machines on my network; a php script on the Cacti server added an IP address xxx.xxx.1.52. Seeing this as odd since I haven't configured any machine with this IP as it's in the DHCP range on my network and there aren't any machines running on DHCP on the particular VLAN either as everything is statically configured; I proceeded to check the arp cache of my NetBSD box which pointed to the MAC address of my FreeBSD server? Having a look round my network and servers each ping attempt to xxx.xxx.1.52 gives me a response and in the arp cache of each machine/device shows the FreeBSD server. Long ago I may have had this machine on xxx.xxx.1.52 but I can't recall and all settings in /etc/rc.conf for interfaces and Jails are fine and consistent with my Network Spec. My network has also had a massive overhaul since then as I've changed switches and router in the meantime too.... I have thought about arp poisoning but then again no other machine is connected to my network that I don't know about and since it's a home network there's really only me connected to it. Also I'm running OpenBSD as a firewall/router gateway which I've also checked thoroughly including Packet Filter and haven't found any issues. I also thought about RARP and bootparamd since I'm running a bunch of Sun SPARC systems in which I NetBooted but nothing on that front either showed any result. I additionally have checked the /etc/hosts files of all my systems and even my local DNS db files but nothing shows xxx.xxx.1.52 at all. The BSD version that I'm running on my FreeBSD server is 8.2 x64. Would anyone be able to help me out with this one? Basically why is a rogue or unknown IP address pointing to my FreeBSD box's NIC? Regards, Kaya