Re: Mysterious broadcast
Hmm,
I guess I don't even partially understand what is going on. That
is not a first for me when it comes to linux!
Anyway, I finally got libpcap and tcpdump installed and her is some
output. This happens every 12 minutes.
tcpdump -i eth0 -c 10
device eth0 entered promiscuous mode
tcpdump: listening on eth0
11:55:15.118933 ipsrvcs3.cdg.ws.netbios-dgm > 10.80.20.255.netbios-dgm:
>>> NBT UDP PACKET(138) Res=0x110E ID=0xD923 IP=10 (0xa).80 (0x50).20
(0x14).63 (0x3f) Port=138 (0x8a) Length=199 (0xc7)
SourceName=IPSRVCS3 NameType=0x20 (Server)
DestName=
WARNING: Short packet. Try increasing the snap length
11:55:15.120519 arsenic.cdg.ws.1057 > ipsrvcs1.cdg.ws.domain: 27209+ PTR?
63.20.80.10.in-addr.arpa. (42) (DF) 11:55:15.122224 arp who-has
arsenic.cdg.ws tell ipsrvcs1.cdg.ws
11:55:15.122249 arp reply arsenic.cdg.ws is-at 0:6:29:6c:96:1b
11:55:15.123764 ipsrvcs1.cdg.ws.domain > arsenic.cdg.ws.1057: 27209* 1/0/0
PTR[|domain] 11:55:15.124288
arsenic.cdg.ws.1057 > ipsrvcs1.cdg.ws.domain: 27210+ PTR?
255.20.80.10.in-addr.arpa. (43) (DF) 11:55:15.125909
ipsrvcs1.cdg.ws.domain > arsenic.cdg.ws.1057: 27210 NXDomain* 0/1/0 (120)
11:55:15.127248 arsenic.cdg.ws.1057 > ipsrvcs1.cdg.ws.domain: 27211+ PTR?
33.20.80.10.in-addr.arpa. (42) (DF) 11:55:15.128916
ipsrvcs1.cdg.ws.domain > arsenic.cdg.ws.1057: 27211* 1/0/0 PTR[11:55:15
|domain] 11:55:15.129341 arsenic.cdg.ws.1057 >
ipsrvcs1.cdg.ws.domain: 27212+ PTR? 61.20.80.10.in-addr.arpa. (42) (DF)
device eth0 left promiscuous mode
[arsenic:~]#
Does this shed any light on anything?
TNX,
Dennis
Matt Zimmerman
<mdz@debian.or To: debian-s390@lists.debian.org
g> cc:
Sent by: Matt Subject: Re: Mysterious broadcast
Zimmerman
<mdz@alcor.net
>
01/09/03 10:02
AM
On Thu, Jan 09, 2003 at 09:42:14AM -0600, Dennis Wicks wrote:
> Thanks for the response, but I think you missed my point.
>
> My debian/linux system should not be broadcasting anything!
> With or without an incorrect netmask!
I think you missed my point. "broadcast" is a concept which is _defined_
by
the netmask. I am not guessing that this is the problem, but it is an
example of how a misconfiguration could cause such behaviour.
> My turbolinux system does not do this and the config is exactly
> the same, except for ip address.
There is absolutely no way for me to divine the problem without seeing the
packets, or at least the complete packet headers, and information about
your
network structure.
--
- mdz
--
To UNSUBSCRIBE, email to debian-s390-request@lists.debian.org
with a subject of "unsubscribe". Trouble? Contact
listmaster@lists.debian.org
Reply to: