• Some users have recently had their accounts hijacked. It seems that the now defunct EVGA forums might have compromised your password there and seems many are using the same PW here. We would suggest you UPDATE YOUR PASSWORD and TURN ON 2FA for your account here to further secure it. None of the compromised accounts had 2FA turned on.
    Once you have enabled 2FA, your account will be updated soon to show a badge, letting other members know that you use 2FA to protect your account. This should be beneficial for everyone that uses FSFT.

Odd NIC card behavior

R

rand4505

Limp Gawd
Joined
Oct 25, 2007
Messages
272
My pfSense firewall running arpwatch detected one of our ancient Server 2003 boxes doing this:

May 1 10:11:54 kernel: arp: 10.1.1.12 moved from XX:XX:XX:XX:XX:0c to XX:XX:XX:XX:XX:08 on bge0
May 1 10:10:46 kernel: arp: 10.1.1.12 moved from XX:XX:XX:XX:XX:08 to XX:XX:XX:XX:XX:0c on bge0

Every ~1hr 30m or so.

Has anyone seen this before? This is a Broadcom card on a Dell server. Was possible thinking Dell OOB software or some other OOB transport could be doing this. If it is Dell based, where/what should I look for to disable/remove? Current A/V and Malwarebytes not detecting anything.

The server is slated to be upgraded shortly, my concern is that it might need to be trashed instead. This Box has no direct connectivity to the outside world, but is sitting next to a box that is.
 
That's interesting, but it could be a whole host of things network wise. how is it connected? what the switch architecture?

Also check what and where the MAC addresses are.
 
I ended up running wireshark on the 12 box over the weekend then grepping for the evil MAC, turns out it was a different box on the network that is "remembering the evil mac" incorrectly and trying to issue querys to that non-existent box. Upon further digging it was an app I was running on the evil box that was causing arp-cache corruption.

Pro-tip: Arpwatch does not tell you WHO is querying the incorrect MAC just the ip and mac association. Seems I assumed it was the IP in question when it was a neighbor.
 
You must log in or register to reply here.
Back
Top