Our local DSL provider lost the ability to provide us with static IPs, so I migrated to AT&T uverse. They installed it and I was able to work with one of their techs to get IP passthrough mode working on the Motorola NVG510 router/gateway and all the ports unblocked on their system. My mail server (running BSD) has a static IP and things are working well. However, I've noticed that I get messages in /var/log/messages every 5 minutes or so.
Loading up a packet sniffer revealed what's going on:
Basically, the AT&T router is doing an ARP broadcast on every private IPs in the subnet and every public IP in the subnet every 5 minutes. I'd say that there's a flaw in the firmware of the router, as the IP it requests the public IPs tell is in the private range and therefore inaccessible. I've dug through the AT&T router settings and there's no option I've been able to find to shut these off.
Does anyone know of a way to make the router stop doing ARP broadcasts every few minutes, if only to certain IPs? What about changing the IP it asks the public IPs report to be the public IP of the modem so it won't fill my logs? Barring both of these options, is there a way for me to tell BSD to simply not log such messages?
Code:
Mar 28 16:09:22 graffdeals kernel: arplookup 192.168.1.254 failed: host is not on local networkLoading up a packet sniffer revealed what's going on:
Code:
16:14:22.996111 arp who-has 192.168.1.253 (Broadcast) tell 192.168.1.254
0x0000: 0001 0800 0604 0001 3060 2362 6ad0 c0a8 ........0`#bj...
0x0010: 01fe ffff ffff ffff c0a8 01fd 696e 6720 ............ing.
0x0020: 0000 0001 0000 0000 0000 5a37 199b ..........Z7..
16:14:23.016878 arp who-has 162-xxx-yyy-113.lightspeed.cityname.sbcglobal.net (Broadcast) tell 192.168.1.254
0x0000: 0001 0800 0604 0001 3060 2362 6ad0 c0a8 ........0`#bj...
0x0010: 01fe ffff ffff ffff a2ed 5c71 0000 0000 ..........\q....
0x0020: 0000 0001 0000 0000 0000 4462 4716 ..........DbG.
16:14:23.016966 arp who-has 162-xxx-yyy-114.lightspeed.cityname.sbcglobal.net (Broadcast) tell 192.168.1.254
0x0000: 0001 0800 0604 0001 3060 2362 6ad0 c0a8 ........0`#bj...
0x0010: 01fe ffff ffff ffff a2ed 5c72 7363 616e ..........\rscan
0x0020: 0000 0001 0000 0000 0000 6ab5 5893 ..........j.X.Basically, the AT&T router is doing an ARP broadcast on every private IPs in the subnet and every public IP in the subnet every 5 minutes. I'd say that there's a flaw in the firmware of the router, as the IP it requests the public IPs tell is in the private range and therefore inaccessible. I've dug through the AT&T router settings and there's no option I've been able to find to shut these off.
Does anyone know of a way to make the router stop doing ARP broadcasts every few minutes, if only to certain IPs? What about changing the IP it asks the public IPs report to be the public IP of the modem so it won't fill my logs? Barring both of these options, is there a way for me to tell BSD to simply not log such messages?