OSEC

Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email hr@neohapsis.com
 
/bsd: arplookup: unable to enter address for 10.111.74.196

From: matt (mattscrapshells.com)
Date: Thu Aug 12 2004 - 01:32:22 CDT


Hello,

My /var/log/messages file is constantly filled with this message. I will
output a tail of it...

Aug 12 00:09:00 www /bsd: arplookup: unable to enter address for 10.111.74.196
Aug 12 00:24:00 www /bsd: arplookup: unable to enter address for 10.111.74.196
Aug 12 00:39:00 www /bsd: arplookup: unable to enter address for 10.111.74.196
Aug 12 00:54:00 www /bsd: arplookup: unable to enter address for 10.111.74.196
Aug 12 01:09:00 www /bsd: arplookup: unable to enter address for 10.111.74.196
Aug 12 01:24:00 www /bsd: arplookup: unable to enter address for 10.111.74.196
Aug 12 01:39:00 www /bsd: arplookup: unable to enter address for 10.111.74.196
Aug 12 01:55:34 www /bsd: arplookup: unable to enter address for 10.111.74.196
Aug 12 02:09:02 www /bsd: arplookup: unable to enter address for 10.111.74.196

I believe it is being generated from my ZyXEL cable router. (ZyXEL P964).
If I disconnect the ethernet cable going to it, the messages subside, and
once I reconnect it, they start again.

I would like to be able to eliminate it from showing up in the logs as it
is really useless and just clutters things up a bit. Here is some
relevant command output:

netstat -rnfinet

Routing tables

Internet:
Destination Gateway Flags Refs Use Mtu Interface
default 24.227.114.129 UGS 3 1274149 - dc1
10.1.0.2 10.1.0.1 UH 1 21 - tun0
24.227.114.128/30 link#2 UC 1 0 - dc1
24.227.114.129 0:2:cf:9:bf:c9 UHLc 1 0 - dc1
24.227.114.130 127.0.0.1 UGHS 0 0 33224 lo0
127/8 127.0.0.1 UGRS 0 0 33224 lo0
127.0.0.1 127.0.0.1 UH 2 328 33224 lo0
172.31.33/24 link#3 UC 4 0 - vr0
172.31.33.1 0:50:2c:a1:6c:f3 UHLc 0 2 - lo0
172.31.33.5 0:4:e2:9c:35:87 UHLc 0 3005 - vr0
172.31.33.7 0:20:35:43:1e:c4 UHLc 3 5271 - vr0
172.31.33.99 0:9:5b:4e:ad:aa UHLc 0 14917 - vr0
192.168.0/24 10.1.0.2 UGS 0 4278 - tun0
224/4 127.0.0.1 URS 0 0 33224 lo0

ifconfig -a

lo0: flags=8049<UP,LOOPBACK,RUNNING,MULTICAST> mtu 33224
        inet 127.0.0.1 netmask 0xff000000
        inet6 ::1 prefixlen 128
        inet6 fe80::1%lo0 prefixlen 64 scopeid 0x6
dc0: flags=8802<BROADCAST,SIMPLEX,MULTICAST> mtu 1500
        address: 00:04:e2:41:d4:4f
        media: Ethernet autoselect (100baseTX full-duplex)
        status: active
dc1: flags=8843<UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST> mtu 1500
        address: 00:04:e2:41:d4:be
        media: Ethernet autoselect (100baseTX full-duplex)
        status: active
        inet 24.227.114.130 netmask 0xfffffffc broadcast 24.227.114.131
        inet6 fe80::204:e2ff:fe41:d4be%dc1 prefixlen 64 scopeid 0x2
vr0: flags=8843<UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST> mtu 1500
        address: 00:50:2c:a1:6c:f3
        media: Ethernet autoselect (100baseTX full-duplex)
        status: active
        inet 172.31.33.1 netmask 0xffffff00 broadcast 172.31.33.255
        inet6 fe80::250:2cff:fea1:6cf3%vr0 prefixlen 64 scopeid 0x3
pflog0: flags=141<UP,RUNNING,PROMISC> mtu 33224
pfsync0: flags=0<> mtu 2020
enc0: flags=0<> mtu 1536
tun0: flags=8051<UP,POINTOPOINT,RUNNING,MULTICAST> mtu 1500
        inet 10.1.0.1 --> 10.1.0.2 netmask 0xffffffff

dc0: has no effect or use right now, it still happens when this is
disconnected

tun0: is being used for vpn stuff, messages continue even with tun0 down.

/etc/hostname.dc1
inet 24.227.114.130 255.255.255.252 NONE

/etc/mygate
24.227.114.129

This is OpenBSD3.5-stable / i386

The ZyXEL router is not configured to be offering DHCP as well.
If anyone has any ideas on what this is, or at least how to filter it out
of the logs, I do appreciate it. Thanks,

                                -Matt-