General Questions

What does this mean? I'm trying to diagnose a rather evasive problem and I'm wondering if this syslog message is related. I asked Google, but Google's translation from Japanese doesn't quite bridge the gap for me. Apparently this message turns up on Mac computers more than anything else, or Mac users are the only ones inclined to post publicly about it. Japanese Mac users.

db

Is this a cable modem?   I found this FreeBSD related post:

http://lists.freebsd.org/pipermail/freebsd-questions/2006-March/115561.html

Apparently the user receives this message when the cable modem goes offline.

Thanks for the link. My mono is actually on static IP, and the uplink is up (save for the possibility of transient disconnects?) when the line in question is logged.

I haven't been able to link the log entry with any specific behaviour of the system, although I have my suspicions: We have had occasional reports from LAN users of web pages not loading or half loading. We were also seeing a lot (70 000+ in a few weeks) of CRC errors on our AP.

We removed some surge suppressors from the AP almost 4 days ago and the CRC errors ceased, as have the log entries in question. Prior to this change I was seeing this log entry an average of four times daily. I suspect therefore that the log entry was related to these CRC errors. I haven't heard a peep about dropped connections in four days either, so I'm about ready to call it case closed, although I still don't really understand the true meaning of that ARP log message. Oh well.

db

I'm refreshing this thread for 2 reasons. First, somebody has started a thread inquiring about an apparently related message wherein the IP address is 1.1.1.1 instead of 0.0.0.0. Second, I'm still getting this message despite having replaced a faulty switch and no more CRC errors.

So I'm still seeing this message a handful of times daily. No known explanation, no correlated symptoms. As mentioned in my last post, some of our clients have complained of disconnected sessions, but I don't know if that's related.

db

This is possibly different from the other person seeing the 1.1.1.1. That's almost certainly somebody that configured something stupid on the same ISP's network. Seeing 0.0.0.0 could be something different, though it could also be the same thing. I don't think it's as likely to be stupid user error because I don't know of any OS that'll let you assign 0.0.0.0 as an IP (though I can't say I've ever tried...it doesn't seem likely).

The only reason I can think of that you'd see this is what sullrich posted, if the DHCP client loses its lease it uses 0.0.0.0 and it could potentially be doing lookups on that address and get weirded out. Since you're using a static IP, that's not the case.

To figure out where it's coming from and get to the bottom of this, you'll really have to put up a network sniffer and capture traffic to a file. When this log comes up, go back and look at what happened at that time and you'll see what causes this.

Or, if you grok C better than I do, see sys/netinet/if_ether.c which is where the code is that logs that message. I know why it comes up, I just don't see what exactly would make it do a lookup, or what exactly it's seeing on the wire that it's griping about.