Arpwatch and NICS

Aly Dharshi aly.dharshi at uleth.ca
Mon Mar 11 02:35:01 CST 2002


Hi All,

    Recently our Network Admin has been complaining that his arpwatch returns messages such as (attachements are from my run of arpwatch):

    subject:    reused old ethernet address (pictor.netsrv.uleth.ca)
    
    hostname:    pictor.netsrv.uleth.ca
    ip address:    142.66.35.146
    ethernet address: 0:2:b3:8f:12:b4
    ethernet vendor: <unknown>
    old ethernet address: 0:6:5b:39:36:fd
    old ethernet vendor: <unknown>
    timestamp: Thursday, March 7, 2002 4:46:12 -0700
    previous timestamp: same as above
    delta: 0 seconds

    What is interesting is that there are 2 NICs broadcom 5700, 2 Intel express pros.

    polaris is the bcm5700 eth0
    pisces 1st Intel Pro 100 eth1
    pictor 2nd Intel Pro 100 eth2

    We set them up as eth0, eth1 and eth2 via linuxconf.

    Now ethernet address is of pisces, old ethernet address is of pictor and if the card ends in "fe" then its polaris. We have even had reports of flip flop of addresses. 

    Please help, I have looked thru all the logs that I can find and know about, nothing, it seems that everything is still going out thru eth2 despite attempts to force things thru the broadcom eth0. NFS mounts, chats with our LDAP server which we expect to go thru eth0 go thru eth2.

    Any advice or help would be much appreciated. ARP commands out puts the following:

    Address                  HWtype  HWaddress           Flags Mask            Iface
oberon.netsrv.uleth.ca   ether   08:00:20:8D:F1:59   C                     eth2
acad2.cc.uleth.ca        ether   AA:00:04:00:03:C0   C                     eth2
Entries: 2      Skipped: 0      Found: 2

    Thank you very much.

    Cheers,

        Aly.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.us.dell.com/pipermail/linux-poweredge/attachments/20020311/425c09a8/attachment.htm
-------------- next part --------------
An embedded message was scrubbed...
From: arpwatch at test.uleth.ca
Subject: changed ethernet address (pictor.netsrv.uleth.ca)
Date: Mon, 11 Mar 2002 00:09:10 -0700
Size: 1475
Url: http://lists.us.dell.com/pipermail/linux-poweredge/attachments/20020311/425c09a8/changedethernetaddresspictor.netsrv.uleth.ca.eml
-------------- next part --------------
An embedded message was scrubbed...
From: arpwatch at test.uleth.ca
Subject: new station (pictor.netsrv.uleth.ca)
Date: Mon, 11 Mar 2002 00:09:10 -0700
Size: 1301
Url: http://lists.us.dell.com/pipermail/linux-poweredge/attachments/20020311/425c09a8/newstationpictor.netsrv.uleth.ca.eml


More information about the Linux-PowerEdge mailing list