arplookup problems

[Gleb Smirnoff]

On Tue, Sep 27, 2005 at 02:44:54AM -0400, Daemon wrote:
D> I hope this is the correct list to post to, if not, I apologize.  I've
D> had an ongoing problem with arplookup for some months now and as of yet,
D> haven't been able to find anything on the web concerning my particular
D> problem.  Every 24 hours, almost to the minute, I get the following errors;
D> 
D> *Note This proceeds each arplookup failure
D> em0: Link is Down
D> em0: Link is up 100 Mbps Full Duplex
D> 
D> Sep 25 01:32:49 thisbox kernel: arplookup 169.0.0.1 failed: host is not
D> on local network
D> Sep 25 01:33:05 thisbox kernel: arplookup 10.32.240.171 failed: host is
D> not on local network
D> Sep 26 01:23:37 thisbox kernel: arplookup 169.0.0.1 failed: host is not
D> on local network
D> Sep 26 01:23:49 thisbox kernel: arplookup 10.32.240.171 failed: host is
D> not on local network
D> Sep 27 01:23:35 thisbox kernel: arplookup 169.0.0.1 failed: host is not
D> on local network
D> Sep 27 01:23:48 thisbox kernel: arplookup 10.32.240.171 failed: host is
D> not on local network

In most cases this means that system have received ARP reply for a host,
that doesn't belong to an attached network.

D> When this happens, one by one, each of my (ssh, gaim, irc, etc.)
D> connections time out until every connection is dead.

It looks like some "Ethernet cool hacker" does ARP spoofing in your network.
May be he spoofs your ARP cache or cache of your gateway. You can solve the
problem by finding him, or by setting static ARP entries on your box and
on gateway.

-- 
Totus tuus, Glebius.
GLEBIUS-RIPN GLEB-RIPE