Mac address changed ??

[James Smallacombe]

Please disregard this...sleep deprication...the IP in questions (which I 
should have disfuised anyway) was not my server's IP, but that of the 
default gateway...the problem was external.

On Wed, 10 Feb 2010, James Smallacombe wrote:

>
> This freaked me out a bit, so I'm just running it past the list to make sure 
> this is just a hardware issue...I've never seen it before.
>
> My dedicated server provider replaced my defective server that had been up 
> for 6 months after it had apparent failures of a NIC and hard drives.  It had 
> also recently been the victim of the Zen Cart exploits (I posted about this 
> not long ago).
>
> Tonight I lost connectivity to it, got in via KVM/IP and saw this in the 
> syslog:
>
> Feb 10 20:42:51 mail kernel: arp: 209.17.170.1 moved from 00:17:e0:4f:b9:c0 
> to 00:13:e0:4f:b9:c0 on re0
>
> My first reaction was that somebody else on the LAN had used my IP address, 
> which would have explained the connectivity issues.  However, the IP couldn't 
> be pinged and I also noticed that only one number in the address had 
> changed...the odds of somebody else having it were long. ifconfig showed the 
> I/F down, no carrier.
>
> I rebooted and then it came up with yet a third MAC address, 
> 00:14:d1:3c:1e:31  Not really even close.  Still no carrier.  Provider swaps 
> out the Realtek NIC for a new one and it's working (for now).
>
> Questions that come to mind: could their be a DoS perhaps from a bot or 
> c99shell I didn't find?  Even if their was, would it be possible for the 
> "www" user, with no priveleges to even cause this kind of problem?  I had 
> disabled suhosin after customers patched their Zen Carts, because it 
> interfered with it.
>
> Or...could this be a bug in the re0 driver?  It's just weird.
>
> James Smallacombe		      PlantageNet, Inc. CEO and Janitor
> up at 3.am							    http://3.am
> =========================================================================
>

James Smallacombe		      PlantageNet, Inc. CEO and Janitor
up at 3.am							    http://3.am
=========================================================================