republican-creole
site Search:


 
    All Forums Hot Topics Gallery






how-to block ads


 
Search Topic:
Share Topic
Posting?
Post a:
Post a:
Links: ·Forum Rules ·Need Help ·MC Policies ·FAQ ·MC Homepage ·Links
AuthorAll Replies


sigsegv

@mchsi.com

reply to WizLayer

Re: arp info overwritten (OpenBSD)

i've been having the arp flood problem for over a month now.
sometimes 2000+ arp requests per second.
here's a snort log from a couple of weeks ago:
»www.quantumfish.com/files/snort.log.txt
i don't have any linksys hardware. my cablemodem is a motorola and it doesn't matter what device is plugged into it for the arps to be received.
so, any other ideas?


claydean

join:2003-04-22
Ankeny, IA

BAINCH was not saying that the people who were getting the floods had linksys hardware. What was stated is that the particular routers were the cause of the floods.


WizLayer

join:2003-10-13
Omega, GA

reply to sigsegv
Sig,

These logs look about normal... except... I would wonder why there are so many dhcpds at the helm... A couple, okay... but my quick look through it shows 8. That seems a little much. Mediacom would be better to split this up a little more (especially if they expect growth in their customer base).

It could also be that they are not filtering the noise between clusters, which would be an easy fix.

Of course, it could also be due to idiot client's gateways who who haven't yet learned to point dhcpd in the right direction.

If you're getting 2000+ arp requests per second at any time, then it should _definately_ get split up... or they should round up the idiot clients ahd hold a public hazing. (Whichever the case may be... )

Try to get a dump when arp traffic is like you say. Then send it to Mediacom and ask them to explain it. If they tell you that you need to reset your modem, that you must be configured incorrectly, or that they have no idea what you're talking about, then insist on talking to someone else.

Good luck,

WizLayer


Monday, 04-Jun 00:27:32 Terms of Use & Privacy | feedback | contact | Hosting by nac.net - DSL,Hosting & Co-lo
over 12.5 years online © 1999-2012 dslreports.com.
Most commented news this week
Hot Topics