Re: split entries from syslogd

2016-02-11 Thread Stuart Henderson
On 2016/02/11 13:34, Todd C. Miller wrote: > On Thu, 11 Feb 2016 10:39:53 +, Stuart Henderson wrote: > > > I updated some firewalls to -current yesterday (from somewhere between > > 5.6 and 5.7) and am now seeing a lot of "arp: attempt to add entry" > > logged, see below. (Looks like someone h

Re: split entries from syslogd

2016-02-11 Thread Todd C. Miller
On Thu, 11 Feb 2016 10:39:53 +, Stuart Henderson wrote: > I updated some firewalls to -current yesterday (from somewhere between > 5.6 and 5.7) and am now seeing a lot of "arp: attempt to add entry" > logged, see below. (Looks like someone has put a machine on the wrong > vlan and it's sending

Re: split entries from syslogd

2016-02-11 Thread Stuart Henderson
On 2016/02/11 10:39, Stuart Henderson wrote: > Other examples of the splitting: And an extra-special blank one here :-) Feb 11 12:51:50 fw1 /bsd: arp: attempt to add entry for 192.168.43.131 on carp432 by 00:26:b9:5d:24:e7 on vlan411 Feb 11 12:51:50 fw1 /bsd: arp: attempt to add entry for 192.16

split entries from syslogd

2016-02-11 Thread Stuart Henderson
I updated some firewalls to -current yesterday (from somewhere between 5.6 and 5.7) and am now seeing a lot of "arp: attempt to add entry" logged, see below. (Looks like someone has put a machine on the wrong vlan and it's sending out broadcast arp replies for conflict detection which are triggerin