From owner-freebsd-questions@FreeBSD.ORG Mon Mar 17 03:49:26 2008 Return-Path: Delivered-To: freebsd-questions@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34]) by hub.freebsd.org (Postfix) with ESMTP id C08E1106566B for ; Mon, 17 Mar 2008 03:49:26 +0000 (UTC) (envelope-from brent.jones@otago.ac.nz) Received: from mailhub2.otago.ac.nz (mailhub2.otago.ac.nz [139.80.64.247]) by mx1.freebsd.org (Postfix) with ESMTP id 360C68FC22 for ; Mon, 17 Mar 2008 03:49:25 +0000 (UTC) (envelope-from brent.jones@otago.ac.nz) Received: from its-ex-p04.registry.otago.ac.nz (its-ex-p04.registry.otago.ac.nz [10.4.15.133]) by mailhub2.otago.ac.nz (8.13.8/8.13.8) with ESMTP id m2H3nNeU005028; Mon, 17 Mar 2008 16:49:24 +1300 Received: from its-ex-p05.registry.otago.ac.nz ([10.4.15.134]) by its-ex-p04.registry.otago.ac.nz with Microsoft SMTPSVC(6.0.3790.3959); Mon, 17 Mar 2008 16:49:24 +1300 Received: from MAIL1.registry.otago.ac.nz ([10.4.15.129]) by its-ex-p05.registry.otago.ac.nz with Microsoft SMTPSVC(6.0.3790.3959); Mon, 17 Mar 2008 16:49:24 +1300 X-MimeOLE: Produced By Microsoft Exchange V6.5 Content-class: urn:content-classes:message MIME-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable Date: Mon, 17 Mar 2008 16:49:23 +1300 Message-ID: <31AE442CCBC1094ABC40CE85B0149F06523974@MAIL1.registry.otago.ac.nz> In-Reply-To: <64c038660803162036x661ae5fbgdf2d00f0dcc7d163@mail.gmail.com> X-MS-Has-Attach: X-MS-TNEF-Correlator: Thread-Topic: ARP(4) spoofing? Thread-Index: AciH4EhnJoZn8hCVTrmeG/siMtIl9gAAW4sg References: <64c038660803162036x661ae5fbgdf2d00f0dcc7d163@mail.gmail.com> From: "Brent Jones" To: "Modulok" , X-OriginalArrivalTime: 17 Mar 2008 03:49:24.0105 (UTC) FILETIME=[E3E77F90:01C887E1] Cc: Subject: RE: ARP(4) spoofing? X-BeenThere: freebsd-questions@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: User questions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 17 Mar 2008 03:49:26 -0000 > -----Original Message----- > From: owner-freebsd-questions@freebsd.org=20 > [mailto:owner-freebsd-questions@freebsd.org] On Behalf Of Modulok > Sent: Monday, 17 March 2008 4:36 p.m. > To: freebsd-questions@freebsd.org > Subject: ARP(4) spoofing? >=20 > Would this be ARP(4) spoofing, or is it just me? How would I=20 > confirm it? >=20 > arp: 192.168.1.1 is on lo0 but got reply from xx:xx:xx:xx:xx:xx on em1 > last message repeated 18 times > This is on a FreeBSD router, em1 is Internet-facing. 192.168.1.1 (em0) > is LAN facing and permanent entry in the arp cache. This happens > constantly and is slowly filling my log files. >=20 > Thoughts? Suggestions? > -Modulok- What does an "ifconfig -a" on your machine show? It looks like you've configured your loopback interface to also have 192.168.1.1 Cheers, Brent