[TriLUG] Arp overflows on Roadrunner?

[Corey Mutter]

I've been seeing a lot of these in my firewall's logs, always during the 
wee hours of the morning:

Nov  3 05:44:19 ash kernel: Neighbour table overflow.
Nov  3 05:44:39 ash kernel: NET: 1 messages suppressed.
Nov  3 05:44:39 ash kernel: Neighbour table overflow.
Nov  3 05:45:12 ash last message repeated 2 times

Right now the arp table has only one entry on the Roadrunner interface
(as you might expect), and nothing out of the ordinary on the internal or
the wireless interfaces. 

I haven't done any checking of the table during these overflow conditions
(due to the times) so I can't be sure of which interface these are happening
on. I doubt it's the wireless because of the rather secluded location, plus
the WAP and iptables are limiting that interface to a short list of source
MACs. 

I wondered if others have been seeing this on Roadrunner, before I go and 
try to figure out if one of my internal machines is spraying garbage 
packets. I suppose it could be a script kiddie, though I can't figure out 
what he/she might be trying to accomplish...

Corey
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 232 bytes
Desc: not available
URL: <http://www.trilug.org/pipermail/trilug/attachments/20031103/f403cbdc/attachment.pgp>