All of lore.kernel.org
 help / color / mirror / Atom feed
From: "Alex" <alex@hostingcenter.ro>
To: lartc@vger.kernel.org
Subject: Re: [LARTC] Neighbour table overflow
Date: Tue, 24 Feb 2004 21:51:32 +0000	[thread overview]
Message-ID: <001a01c3fb20$5d924c60$05fea8c0@admin> (raw)
In-Reply-To: <marc-lartc-103923568826933@msgid-missing>

I'm doing NAT for 200 workstations and 2 gre tunels with 4 users each. I
also have in mangle table in PRETOURING chain, DROP rules for ports commonly
used by blaster, welchia and other worms. I have never seen this problem
until now and I did not get the chance to verify it under kernel 2.4.X.

I use one class C private with private ips + another 2 class C for tunels.

Maybe this message is because my users frequently scan the network with
WS_PING to see what users are online (this produces arp-requests for each ip
in that ip class)?

Alex Iruc


----- Original Message ----- 
From: "Damjan" <gdamjan@mail.net.mk>
To: <lartc@mailman.ds9a.nl>
Cc: "Alex" <alex@hostingcenter.ro>
Sent: Tuesday, February 24, 2004 11:12 PM
Subject: Re: [LARTC] Neighbour table overflow


> > What is the cause for such a message while running kernel 2.6.1 on RH9 ?
> >
> > Neighbour table overflow.
> > NET: 282 messages suppressed.
> > Neighbour table overflow.
>
> ARP table overflow,
> do you have an interface on your router with a too wide netmask?
> /16 (255.255.0.0) maybe?
> Do you have a lot of "(incomplete)" entries in "arp -n"?
>
> Check that interface with "tcpdump -i eth? -n arp".
>
> Probably some virus or port sniffer tries to scan your network.
>
> -- 
> Damjan Georgievski
> jabberID: damjan@bagra.net.mk
>
>


_______________________________________________
LARTC mailing list / LARTC@mailman.ds9a.nl
http://mailman.ds9a.nl/mailman/listinfo/lartc HOWTO: http://lartc.org/

  parent reply	other threads:[~2004-02-24 21:51 UTC|newest]

Thread overview: 12+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2002-12-07  4:41 [LARTC] Neighbour table overflow Arindam Haldar
2002-12-07  4:41 ` Arindam Haldar
2002-12-07  9:35 ` Petru Paler
2002-12-08  3:53 ` Arindam Haldar
2004-02-22  3:22 ` Alex
2004-02-22  5:49 ` Santiago J. Ruano Rincón
2004-02-22  6:56 ` Alex
2004-02-22  8:12 ` Søren Kent Jensen
2004-02-22 10:11 ` arek
2004-02-24 21:12 ` Damjan
2004-02-24 21:51 ` Alex [this message]
2004-02-25 21:09 ` Simon Byrnand

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to='001a01c3fb20$5d924c60$05fea8c0@admin' \
    --to=alex@hostingcenter.ro \
    --cc=lartc@vger.kernel.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body. 
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.