Prev: Lost sound after kernel upgrade
Next: do_IRQ: 0.83 error
From: Chris Davies on 27 Apr 2010 15:03
> If you've got someone to follow this though, that's great. If not,
> consider running something like arpwatch on one of your linux boxes that
> /isn't/ having the problem. (This will log all ethernet/IP address pairs,
> and flag up any that change or are duplicated.)

D.M. Procida <real-not-anti-spam-address(a)apple-juice.co.uk> wrote:
> All ethernet/IP address pairs from where? The entire network? Or just
> the system affected?

You only need to worry about this MAC conflict issue on your local network
(LAN), the perimeter of which is bounded by one or more routers. (MAC
addresses aren't visible through routers.)

Chris
From: D.M. Procida on 27 Apr 2010 16:23
Chris Davies <chris-usenet(a)roaima.co.uk> wrote:

> > If you've got someone to follow this though, that's great. If not,
> > consider running something like arpwatch on one of your linux boxes that
> > /isn't/ having the problem. (This will log all ethernet/IP address pairs,
> > and flag up any that change or are duplicated.)
>
> D.M. Procida <real-not-anti-spam-address(a)apple-juice.co.uk> wrote:
> > All ethernet/IP address pairs from where? The entire network? Or just
> > the system affected?
>
> You only need to worry about this MAC conflict issue on your local network
> (LAN), the perimeter of which is bounded by one or more routers. (MAC
> addresses aren't visible through routers.)

There are several thousand machines on our network... possibly tens of
thousands, but I am not actually sure whether the way it is segmented
breaks it up.

Daniele
From: Chris Davies on 27 Apr 2010 17:37
D.M. Procida <real-not-anti-spam-address(a)apple-juice.co.uk> wrote:
> There are several thousand machines on our network... possibly tens of
> thousands, but I am not actually sure whether the way it is segmented
> breaks it up.

Then start with the most likely place, like I suggested originally,
and check whether any of the VMs cloned from the same start point have
the same MAC address. (They shouldn't.) If that draws a blank then use
one of the unaffected linux boxes to run arpwatch for a day or so.

Chris
From: D.M. Procida on 28 Apr 2010 04:52
Chris Davies <chris-usenet(a)roaima.co.uk> wrote:

> D.M. Procida <real-not-anti-spam-address(a)apple-juice.co.uk> wrote:
> > There are several thousand machines on our network... possibly tens of
> > thousands, but I am not actually sure whether the way it is segmented
> > breaks it up.
>
> Then start with the most likely place, like I suggested originally,
> and check whether any of the VMs cloned from the same start point have
> the same MAC address. (They shouldn't.) If that draws a blank then use
> one of the unaffected linux boxes to run arpwatch for a day or so.

Thanks for the help. arpwatch (actually, Mocha) found it straight away:
another machine on the network somewhere is grabbing that one's IP
address, probably because someone has given it a manually-assigned
address.

I have asked for the culprit to be hunted down and punished.

I'm not sure what could be done to prevent this - presumably, someone
could give their machines the same IP addresses as the main webservers',
and interefere with them in that way.

Daniele
From: Bernard Peek on 28 Apr 2010 05:28
On 28/04/10 09:52, D.M. Procida wrote:
> Chris Davies<chris-usenet(a)roaima.co.uk> wrote:
>
>> D.M. Procida<real-not-anti-spam-address(a)apple-juice.co.uk> wrote:
>>> There are several thousand machines on our network... possibly tens of
>>> thousands, but I am not actually sure whether the way it is segmented
>>> breaks it up.
>>
>> Then start with the most likely place, like I suggested originally,
>> and check whether any of the VMs cloned from the same start point have
>> the same MAC address. (They shouldn't.) If that draws a blank then use
>> one of the unaffected linux boxes to run arpwatch for a day or so.
>
> Thanks for the help. arpwatch (actually, Mocha) found it straight away:
> another machine on the network somewhere is grabbing that one's IP
> address, probably because someone has given it a manually-assigned
> address.
>
> I have asked for the culprit to be hunted down and punished.

Are you going to sell tickets for that?


--
Bernard Peek
bap(a)shrdlu.com
First  |  Prev  |  Next  |  Last
Pages: 1 2 3 4
Prev: Lost sound after kernel upgrade
Next: do_IRQ: 0.83 error