LINUX.ORG.RU
Форум — General  

почему у меня весь день меняеться hw addr ? oO


0

0 

nvelope-to: root@blackice.farline.net
Delivery-date: Sun, 10 Feb 2008 14:04:09 +0200
From: "Arpwatch blackICE.farline.net" <arpwatch@blackice.farline.net>
To: root@blackice.farline.net
Subject: flip flop (blackICE.farline.net) eth0

            hostname: blackICE.farline.net
          ip address: 192.168.173.61
           interface: eth0
    ethernet address: 0:e0:4d:d:33:cd
     ethernet vendor: Internet Initiative Japan, Inc
old ethernet address: 0:f:ea:60:a0:48
 old ethernet vendor: Giga-Byte Technology Co.,Ltd.
           timestamp: Sunday, February 10, 2008 14:03:59 +0200
  previous timestamp: Sunday, February 10, 2008 14:01:30 +0200
               delta: 2 minutes

--------------

Envelope-to: root@blackice.farline.net
Delivery-date: Sun, 10 Feb 2008 14:04:24 +0200
From: "Arpwatch blackICE.farline.net" <arpwatch@blackice.farline.net>
To: root@blackice.farline.net
Subject: flip flop (blackICE.farline.net) eth0

            hostname: blackICE.farline.net
          ip address: 192.168.173.61
           interface: eth0
    ethernet address: 0:f:ea:60:a0:48
     ethernet vendor: Giga-Byte Technology Co.,Ltd.
old ethernet address: 0:e0:4d:d:33:cd
 old ethernet vendor: Internet Initiative Japan, Inc
           timestamp: Sunday, February 10, 2008 14:04:24 +0200
  previous timestamp: Sunday, February 10, 2008 14:04:01 +0200
               delta: 23 seconds

--------------------
...
            hostname: blackICE.farline.net
          ip address: 192.168.173.61
           interface: eth0
    ethernet address: 0:e0:4d:d:33:cd
     ethernet vendor: Internet Initiative Japan, Inc
old ethernet address: 0:f:ea:60:a0:48
 old ethernet vendor: Giga-Byte Technology Co.,Ltd.
           timestamp: Sunday, February 10, 2008 14:07:12 +0200
  previous timestamp: Sunday, February 10, 2008 14:06:45 +0200
               delta: 27 seconds


----------------
...

            hostname: blackICE.farline.net
          ip address: 192.168.173.61
           interface: eth0
    ethernet address: 0:f:ea:60:a0:48
     ethernet vendor: Giga-Byte Technology Co.,Ltd.
old ethernet address: 0:e0:4d:d:33:cd
 old ethernet vendor: Internet Initiative Japan, Inc
           timestamp: Sunday, February 10, 2008 14:07:17 +0200
  previous timestamp: Sunday, February 10, 2008 14:07:12 +0200
               delta: 5 seconds


и так весь день
what happents ? oO
★
← Шифровка раздела винчестера ГОСТ`ом
Иксы не стартуют →
Ответ на: комментарий от sdio 

# dmesg

....
ReiserFS: sda8: Using r5 hash to sort names
FAT: utf8 is not a recommended IO charset for FAT filesystems, filesystem will be case sensitive!
EXT2-fs warning: mounting unchecked fs, running e2fsck is recommended
eth1: link down
Clocksource tsc unstable (delta = -81782625 ns)
Bluetooth: L2CAP ver 2.8
Bluetooth: L2CAP socket layer initialized
Bluetooth: RFCOMM socket layer initialized
Bluetooth: RFCOMM TTY layer initialized
Bluetooth: RFCOMM ver 1.8
vboxdrv: Trying to deactivate the NMI watchdog permanently...
vboxdrv: Successfully done.
PPP Deflate Compression module registered
nvidia: module license 'NVIDIA' taints kernel.
ACPI: PCI Interrupt Link [APC7] enabled at IRQ 16
ACPI: PCI Interrupt 0000:00:05.0[A] -> Link [APC7] -> GSI 16 (level, low) -> IRQ 17
PCI: Setting latency timer of device 0000:00:05.0 to 64
NVRM: loading NVIDIA UNIX x86 Kernel Module  100.14.19  Wed Sep 12 14:12:24 PDT 2007
eth1: link up, 100Mbps, full-duplex, lpa 0x41E1

нет все в порядке


провайде меняет перебивает заново некоторые подсети в сети
это может быть как-то связано ?

chkrootkit - ничего не находит
tiger - тоже ничего подозрительного не находит


подскажите, вообще, в какую сторону смотерть ??

hose ★
() автор топика
Ответ на: комментарий от hose 

причем у машин в этой же подсети кажеться такие же проблеммы 
(во всяком случае arpwatch о них мне тоже пишет)

Envelope-to: root@blackice.farline.net
Delivery-date: Sun, 10 Feb 2008 20:55:14 +0200
From: "Arpwatch blackICE.farline.net" <arpwatch@blackice.farline.net>
To: root@blackice.farline.net
Subject: flip flop (host-1.lan-107.farline.net) eth0

            hostname: host-1.lan-107.farline.net
          ip address: 192.168.107.1
           interface: eth0
    ethernet address: 0:17:31:6f:44:fd
     ethernet vendor: <unknown>
old ethernet address: 0:e0:4d:d:33:cd
 old ethernet vendor: Internet Initiative Japan, Inc
           timestamp: Sunday, February 10, 2008 20:55:14 +0200
  previous timestamp: Sunday, February 10, 2008 20:55:14 +0200
               delta: 0 seconds

nvelope-to: root@blackice.farline.net
Delivery-date: Sun, 10 Feb 2008 20:55:14 +0200
From: "Arpwatch blackICE.farline.net" <arpwatch@blackice.farline.net>
To: root@blackice.farline.net
Subject: flip flop (host-1.lan-107.farline.net) eth0

            hostname: host-1.lan-107.farline.net
          ip address: 192.168.107.1
           interface: eth0
    ethernet address: 0:e0:4d:d:33:cd
     ethernet vendor: Internet Initiative Japan, Inc
old ethernet address: 0:17:31:6f:44:fd
 old ethernet vendor: <unknown>
           timestamp: Sunday, February 10, 2008 20:55:14 +0200
  previous timestamp: Sunday, February 10, 2008 20:55:14 +0200
               delta: 0 seconds

Envelope-to: root@blackice.farline.net
Delivery-date: Sun, 10 Feb 2008 20:55:14 +0200
From: "Arpwatch blackICE.farline.net" <arpwatch@blackice.farline.net>
To: root@blackice.farline.net
Subject: changed ethernet address (host-1.lan-107.farline.net) eth0

            hostname: host-1.lan-107.farline.net
          ip address: 192.168.107.1
           interface: eth0
    ethernet address: 0:e0:4d:d:33:cd
     ethernet vendor: Internet Initiative Japan, Inc
old ethernet address: 0:17:31:6f:44:fd
 old ethernet vendor: <unknown>
           timestamp: Sunday, February 10, 2008 20:55:14 +0200
  previous timestamp: Sunday, February 10, 2008 16:31:29 +0200
               delta: 4 hours



и есть еще письма с другими ip адрессами

бока провайдера ?
можно звонить и рычать в трубку ?
что кокретно сказать ? оО

hose ★
() автор топика
Ответ на: комментарий от hose

всем спасибо за советы

поговорил с провайдером
выяснелось что кто-то занял мой ip

hose ★
() автор топика
Вы не можете добавлять комментарии в эту тему. Тема перемещена в архив.
← Шифровка раздела винчестера ГОСТ`ом
General
Иксы не стартуют →