From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from MAIL1.WPI.EDU (MAIL1.WPI.EDU [130.215.36.91]) by huchra.bufferbloat.net (Postfix) with ESMTP id E20DC200BD0 for ; Sat, 1 Feb 2014 05:29:53 -0800 (PST) Received: from MAIL1.WPI.EDU (MAIL1.WPI.EDU [130.215.36.91]) by MAIL1.WPI.EDU (8.14.8/8.14.7) with ESMTP id s11DTqRe023271 for ; Sat, 1 Feb 2014 08:29:52 -0500 X-DKIM: Sendmail DKIM Filter v2.8.3 MAIL1.WPI.EDU s11DTqRe023271 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=wpi.edu; s=_dkim; t=1391261392; bh=fyV3n73sB1nZ9R6mrV5DyKMtJ9HzCopIObvMileOHes=; h=Date:From:To:Subject:Message-ID:MIME-Version:Content-Type; b=b2eu+yaA4eyiWE3aQybm3bUZr0A4mcAKWBdZr5SaF9nfCLZHM2I2ehldFMHlIsUww LHAvwo2psMN2oMxx+hR6FS63SKP7I8RtVRpyqycuSNk2ixR9NUMN57wSGI02NUt6vv 35Kcp1oMfHkrE3mK3GPAINQ8BMtmid6S8O0WlBu8= Received: from SMTP.WPI.EDU (SMTP.WPI.EDU [130.215.36.186]) by MAIL1.WPI.EDU (8.14.8/8.14.8) with ESMTP id s11DTqpZ023267 for ; Sat, 1 Feb 2014 08:29:52 -0500 Received: from angus.ind.WPI.EDU (ANGUS.IND.WPI.EDU [130.215.130.21]) by SMTP.WPI.EDU (8.14.4/8.14.4) with ESMTP id s11DTopK008590 for ; Sat, 1 Feb 2014 08:29:51 -0500 (envelope-from cra@WPI.EDU) Received: from angus.ind.WPI.EDU (localhost [127.0.0.1]) by angus.ind.WPI.EDU (8.14.4/8.14.4) with ESMTP id s11DToJN005485 for ; Sat, 1 Feb 2014 08:29:50 -0500 Received: (from cra@localhost) by angus.ind.WPI.EDU (8.14.4/8.14.4/Submit) id s11DTolZ005484 for cerowrt-devel@lists.bufferbloat.net; Sat, 1 Feb 2014 08:29:50 -0500 X-Authentication-Warning: angus.ind.WPI.EDU: cra set sender to cra@WPI.EDU using -f Date: Sat, 1 Feb 2014 08:29:50 -0500 From: Chuck Anderson To: cerowrt-devel@lists.bufferbloat.net Message-ID: <20140201132948.GU15505@angus.ind.WPI.EDU> Mail-Followup-To: cerowrt-devel@lists.bufferbloat.net MIME-Version: 1.0 Content-Type: multipart/mixed; boundary="d6Gm4EdcadzBjdND" Content-Disposition: inline User-Agent: Mutt/1.5.20 (2009-12-10) Subject: [Cerowrt-devel] odhcp6c went crazy flooding Comcast with DHCPv6 SOLICITs X-BeenThere: cerowrt-devel@lists.bufferbloat.net X-Mailman-Version: 2.1.13 Precedence: list List-Id: Development issues regarding the cerowrt test router project List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 01 Feb 2014 13:29:54 -0000 --d6Gm4EdcadzBjdND Content-Type: text/plain; charset=us-ascii Content-Disposition: inline This morning my Linux PC which has a direct connection to my Comcast cable modem (no router in between) lost its IPv4 address. During troubleshooting, I noticed that the dhclient was unable to get an IPv4 address from Comcast. I ran tcpdump and discovered that the CeroWRT router, also connected to the same cable modem via a switch, was flooding the WAN with DHCPv6 SOLICIT packets with about 4700 packets/sec, 6.6 megabits/sec of traffic! I immediately unplugged CeroWRT from the WAN and then my PC was able to get an IPv4 address from Comcast. I know CeroWrt 3.7.5-2 is old at this point, but I'm wondering if something else changed to cause this behavior. Maybe Comcast IPv6-enabled my CMTS finally? I've been using HE tunnels for IPv6, one on a Linksys OpenWRT for my "production" network and a separate tunnel on this CeroWRT for "testing". There is one other change that was made to my Linux PC--I booted into a new kernel yesterday morning and had a similar problem with the inability to get an IPv4 address via DHCP from Comcast for about 30 minutes, then it just started working on its own. (I hadn't noticed initially since I was using IPv6 to get where I needed to go.) I didn't have time to troubleshoot it at the time, but I assumed it was due to this IPv6 change in the Fedora kernel: * Wed Jan 29 2014 Justin M. Forbes - 3.12.9-201 - ipv6 addrconf: revert /proc/net/if_inet6 ifa_flag format (rhbz 1056711) * Tue Jan 28 2014 Josh Boyer - Add patch from Stanislaw Gruszka to fix ath9k BUG (rhbz 990955) * Mon Jan 27 2014 Justin M. Forbes - 3.12.9-200 - Backport new IPv6 address flag IFA_F_NOPREFIXROUTE and IFA_F_MANAGETEMPADDR (rhbz 1056711) - Linux v3.12.9 - i915: remove pm_qos request on error (rhbz 1057533) See https://bugzilla.redhat.com/show_bug.cgi?id=1056711 for details about that. Each time this loss of IPv4 happened, I noticed the NIC link went down right before it started. Maybe the flooding was happening yesterday morning too, and the flooding caused my poor 5-port Netgear switch to flake out and flap the NIC links? Alternatively, maybe the link flap itself was what caused odhcp6c to wig out and start flooding in the first place? Unfortunately I don't have a tcpdump from yesterday morning to confirm this. CeroWRT status: Router Name cerowrt Router Model NETGEAR WNDR3700v2 Firmware Version CeroWrt Modena 3.7.5-2 / LuCI Trunk (trunk+svn) Kernel Version 3.7.5 Local Time Sat Feb 1 07:54:43 2014 Uptime 58d 6h 56m 51s The DHCPv6 client is odhcp6c: root@cerowrt:~# ps |grep dhc 980 root 1720 S udhcpc -p /var/run/udhcpc-ge00.pid -s /lib/netifd/dh 1335 root 804 R odhcp6c -s /lib/netifd/dhcpv6.script -Ntry -P60 ge00 3725 root 1704 S grep dhc Here is an example packet from the DHCPv6 flood: No. Time Source Destination Protocol Length Info 1 0.000000 fe80::c63d:c7ff:feb0:8f41 ff02::1:2 DHCPv6 179 Solicit XID: 0x45eb91 CID: 00030001c43dc7b08f41 Frame 1: 179 bytes on wire (1432 bits), 179 bytes captured (1432 bits) Encapsulation type: Ethernet (1) Arrival Time: Feb 1, 2014 07:20:27.723633000 EST [Time shift for this packet: 0.000000000 seconds] Epoch Time: 1391257227.723633000 seconds [Time delta from previous captured frame: 0.000000000 seconds] [Time delta from previous displayed frame: 0.000000000 seconds] [Time since reference or first frame: 0.000000000 seconds] Frame Number: 1 Frame Length: 179 bytes (1432 bits) Capture Length: 179 bytes (1432 bits) [Frame is marked: False] [Frame is ignored: False] [Protocols in frame: eth:ipv6:udp:dhcpv6] [Coloring Rule Name: UDP] [Coloring Rule String: udp] Ethernet II, Src: Netgear_b0:8f:41 (c4:3d:c7:b0:8f:41), Dst: IPv6mcast_00:01:00:02 (33:33:00:01:00:02) Destination: IPv6mcast_00:01:00:02 (33:33:00:01:00:02) Address: IPv6mcast_00:01:00:02 (33:33:00:01:00:02) .... ..1. .... .... .... .... = LG bit: Locally administered address (this is NOT the factory default) .... ...1 .... .... .... .... = IG bit: Group address (multicast/broadcast) Source: Netgear_b0:8f:41 (c4:3d:c7:b0:8f:41) Address: Netgear_b0:8f:41 (c4:3d:c7:b0:8f:41) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) Type: IPv6 (0x86dd) Internet Protocol Version 6, Src: fe80::c63d:c7ff:feb0:8f41 (fe80::c63d:c7ff:feb0:8f41), Dst: ff02::1:2 (ff02::1:2) 0110 .... = Version: 6 [0110 .... = This field makes the filter "ip.version == 6" possible: 6] .... 0000 0000 .... .... .... .... .... = Traffic class: 0x00000000 .... 0000 00.. .... .... .... .... .... = Differentiated Services Field: Default (0x00000000) .... .... ..0. .... .... .... .... .... = ECN-Capable Transport (ECT): Not set .... .... ...0 .... .... .... .... .... = ECN-CE: Not set .... .... .... 0000 0000 0000 0000 0000 = Flowlabel: 0x00000000 Payload length: 125 Next header: UDP (17) Hop limit: 1 Source: fe80::c63d:c7ff:feb0:8f41 (fe80::c63d:c7ff:feb0:8f41) [Source SA MAC: Netgear_b0:8f:41 (c4:3d:c7:b0:8f:41)] Destination: ff02::1:2 (ff02::1:2) [Source GeoIP: Unknown] [Destination GeoIP: Unknown] User Datagram Protocol, Src Port: dhcpv6-client (546), Dst Port: dhcpv6-server (547) Source port: dhcpv6-client (546) Destination port: dhcpv6-server (547) Length: 125 Checksum: 0xda1c [validation disabled] [Good Checksum: False] [Bad Checksum: False] DHCPv6 Message type: Solicit (1) Transaction ID: 0x45eb91 Elapsed time Option: Elapsed time (8) Length: 2 Value: ffff Elapsed-time: 655350 ms Option Request Option: Option Request (6) Length: 10 Value: 00170018003800160015 Requested Option code: DNS recursive name server (23) Requested Option code: Domain Search List (24) Requested Option code: Unknown (56) Requested Option code: SIP Servers IPv6 Address List (22) Requested Option code: SIP Server Domain Name List (21) Client Identifier Option: Client Identifier (1) Length: 10 Value: 00030001c43dc7b08f41 DUID: 00030001c43dc7b08f41 DUID Type: link-layer address (3) Hardware type: Ethernet (1) Link-layer address: c4:3d:c7:b0:8f:41 Reconfigure Accept Option: Reconfigure Accept (20) Length: 0 Fully Qualified Domain Name Option: Fully Qualified Domain Name (39) Length: 10 Value: 00076365726f77727400 0000 0... = Reserved: 0x00 .... .0.. = N bit: Server should perform DNS updates .... ..0. = O bit: Server has not overridden client's S bit preference .... ...0 = S bit: Server should not perform forward DNS updates Domain: cerowrt Identity Association for Non-temporary Address Option: Identity Association for Non-temporary Address (3) Length: 12 Value: 000000010000000000000000 IAID: 00000001 T1: 0 T2: 0 Identity Association for Prefix Delegation Option: Identity Association for Prefix Delegation (25) Length: 41 Value: 000000010000000000000000001a00190000000000000000... IAID: 00000001 T1: 0 T2: 0 IA Prefix Option: IA Prefix (26) Length: 25 Value: 00000000000000003c000000000000000000000000000000... Preferred lifetime: 0 Valid lifetime: 0 Prefix length: 60 Prefix address: :: (::) 0000 33 33 00 01 00 02 c4 3d c7 b0 8f 41 86 dd 60 00 33.....=...A..`. 0010 00 00 00 7d 11 01 fe 80 00 00 00 00 00 00 c6 3d ...}...........= 0020 c7 ff fe b0 8f 41 ff 02 00 00 00 00 00 00 00 00 .....A.......... 0030 00 00 00 01 00 02 02 22 02 23 00 7d da 1c 01 45 .......".#.}...E 0040 eb 91 00 08 00 02 ff ff 00 06 00 0a 00 17 00 18 ................ 0050 00 38 00 16 00 15 00 01 00 0a 00 03 00 01 c4 3d .8.............= 0060 c7 b0 8f 41 00 14 00 00 00 27 00 0a 00 07 63 65 ...A.....'....ce 0070 72 6f 77 72 74 00 00 03 00 0c 00 00 00 01 00 00 rowrt........... 0080 00 00 00 00 00 00 00 19 00 29 00 00 00 01 00 00 .........)...... 0090 00 00 00 00 00 00 00 1a 00 19 00 00 00 00 00 00 ................ 00a0 00 00 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 ..<............. 00b0 00 00 00 ... The CeroWRT system log is attached. Nothing looks strange except the loss of ge00 link around 6:24 this morning, which is right around when I lost IPv4 connectivity to my Linux PC (I have a system monitoring this IP and it SMS's me if it goes down). My PC's NIC link went down at exactly the same time. At 7:24 is when I unplugged CeroWRT. --d6Gm4EdcadzBjdND Content-Type: text/plain; charset=us-ascii Content-Disposition: attachment; filename="cerowrt-dhcpv6-solicit-flood-system.log" Feb 1 03:44:30 cerowrt daemon.info dnsmasq-dhcp[2896]: RTR-ADVERT(sw10) 2001:470:89c6:2:: Feb 1 03:47:19 cerowrt daemon.info dnsmasq-dhcp[2896]: RTR-ADVERT(se00) 2001:470:89c6:: Feb 1 03:49:38 cerowrt daemon.info hostapd: sw00: STA e0:75:7d:6c:67:de WPA: group key handshake completed (RSN) Feb 1 03:50:22 cerowrt daemon.info dnsmasq-dhcp[2896]: RTR-ADVERT(sw00) 2001:470:89c6:1:: Feb 1 03:53:35 cerowrt daemon.info dnsmasq-dhcp[2896]: RTR-ADVERT(sw10) 2001:470:89c6:2:: Feb 1 03:56:41 cerowrt daemon.info xinetd[2832]: At least 1 DENY_TIME has expired, global_no_access list updated Feb 1 03:57:04 cerowrt daemon.info dnsmasq-dhcp[2896]: RTR-ADVERT(se00) 2001:470:89c6:: Feb 1 03:58:00 cerowrt daemon.crit xinetd[2832]: 2832 {process_sensor} Adding 88.119.198.49 to the global_no_access list for 120 minutes Feb 1 03:58:28 cerowrt daemon.crit xinetd[2832]: 2832 {process_sensor} Adding 58.63.69.150 to the global_no_access list for 120 minutes Feb 1 03:59:08 cerowrt daemon.info dnsmasq-dhcp[2896]: RTR-ADVERT(sw00) 2001:470:89c6:1:: Feb 1 03:59:38 cerowrt daemon.info hostapd: sw00: STA e0:75:7d:6c:67:de WPA: group key handshake completed (RSN) Feb 1 03:59:42 cerowrt daemon.info xinetd[2832]: At least 1 DENY_TIME has expired, global_no_access list updated Feb 1 04:02:32 cerowrt daemon.info dnsmasq-dhcp[2896]: RTR-ADVERT(sw10) 2001:470:89c6:2:: Feb 1 04:06:00 cerowrt daemon.info dnsmasq-dhcp[2896]: RTR-ADVERT(se00) 2001:470:89c6:: Feb 1 04:08:47 cerowrt daemon.info dnsmasq-dhcp[2896]: RTR-ADVERT(sw00) 2001:470:89c6:1:: Feb 1 04:09:38 cerowrt daemon.info hostapd: sw00: STA e0:75:7d:6c:67:de WPA: group key handshake completed (RSN) Feb 1 04:11:20 cerowrt daemon.info dnsmasq-dhcp[2896]: RTR-ADVERT(sw10) 2001:470:89c6:2:: Feb 1 04:13:56 cerowrt daemon.info dnsmasq-dhcp[2896]: RTR-ADVERT(se00) 2001:470:89c6:: Feb 1 04:18:43 cerowrt daemon.info dnsmasq-dhcp[2896]: RTR-ADVERT(sw00) 2001:470:89c6:1:: Feb 1 04:19:38 cerowrt daemon.info hostapd: sw00: STA e0:75:7d:6c:67:de WPA: group key handshake completed (RSN) Feb 1 04:20:12 cerowrt daemon.info dnsmasq-dhcp[2896]: RTR-ADVERT(sw10) 2001:470:89c6:2:: Feb 1 04:21:43 cerowrt daemon.info xinetd[2832]: At least 1 DENY_TIME has expired, global_no_access list updated Feb 1 04:22:12 cerowrt daemon.info dnsmasq-dhcp[2896]: RTR-ADVERT(se00) 2001:470:89c6:: Feb 1 04:28:35 cerowrt daemon.info dnsmasq-dhcp[2896]: RTR-ADVERT(sw00) 2001:470:89c6:1:: Feb 1 04:29:14 cerowrt daemon.info dnsmasq-dhcp[2896]: RTR-ADVERT(sw10) 2001:470:89c6:2:: Feb 1 04:29:38 cerowrt daemon.info hostapd: sw00: STA e0:75:7d:6c:67:de WPA: group key handshake completed (RSN) Feb 1 04:31:12 cerowrt daemon.info dnsmasq-dhcp[2896]: RTR-ADVERT(se00) 2001:470:89c6:: Feb 1 04:32:44 cerowrt daemon.info xinetd[2832]: At least 1 DENY_TIME has expired, global_no_access list updated Feb 1 04:36:44 cerowrt daemon.info dnsmasq-dhcp[2896]: RTR-ADVERT(sw00) 2001:470:89c6:1:: Feb 1 04:38:16 cerowrt daemon.info dnsmasq-dhcp[2896]: RTR-ADVERT(sw10) 2001:470:89c6:2:: Feb 1 04:39:38 cerowrt daemon.info hostapd: sw00: STA e0:75:7d:6c:67:de WPA: group key handshake completed (RSN) Feb 1 04:39:44 cerowrt daemon.info xinetd[2832]: At least 1 DENY_TIME has expired, global_no_access list updated Feb 1 04:41:10 cerowrt daemon.info dnsmasq-dhcp[2896]: RTR-ADVERT(se00) 2001:470:89c6:: Feb 1 04:44:21 cerowrt daemon.info dnsmasq-dhcp[2896]: RTR-ADVERT(sw00) 2001:470:89c6:1:: Feb 1 04:47:58 cerowrt daemon.info dnsmasq-dhcp[2896]: RTR-ADVERT(sw10) 2001:470:89c6:2:: Feb 1 04:49:38 cerowrt daemon.info hostapd: sw00: STA e0:75:7d:6c:67:de WPA: group key handshake completed (RSN) Feb 1 04:50:43 cerowrt daemon.info dnsmasq-dhcp[2896]: RTR-ADVERT(se00) 2001:470:89c6:: Feb 1 04:53:37 cerowrt daemon.info dnsmasq-dhcp[2896]: RTR-ADVERT(sw00) 2001:470:89c6:1:: Feb 1 04:56:01 cerowrt daemon.info dnsmasq-dhcp[2896]: RTR-ADVERT(sw10) 2001:470:89c6:2:: Feb 1 04:57:45 cerowrt daemon.info xinetd[2832]: At least 1 DENY_TIME has expired, global_no_access list updated Feb 1 04:58:14 cerowrt daemon.info dnsmasq-dhcp[2896]: RTR-ADVERT(se00) 2001:470:89c6:: Feb 1 04:59:38 cerowrt daemon.info hostapd: sw00: STA e0:75:7d:6c:67:de WPA: group key handshake completed (RSN) Feb 1 05:01:41 cerowrt daemon.info dnsmasq-dhcp[2896]: RTR-ADVERT(sw00) 2001:470:89c6:1:: Feb 1 05:04:28 cerowrt daemon.info dnsmasq-dhcp[2896]: RTR-ADVERT(sw10) 2001:470:89c6:2:: Feb 1 05:07:24 cerowrt daemon.info dnsmasq-dhcp[2896]: RTR-ADVERT(se00) 2001:470:89c6:: Feb 1 05:09:38 cerowrt daemon.info hostapd: sw00: STA e0:75:7d:6c:67:de WPA: group key handshake completed (RSN) Feb 1 05:09:54 cerowrt daemon.info dnsmasq-dhcp[2896]: RTR-ADVERT(sw00) 2001:470:89c6:1:: Feb 1 05:13:36 cerowrt daemon.info dnsmasq-dhcp[2896]: RTR-ADVERT(sw10) 2001:470:89c6:2:: Feb 1 05:13:40 cerowrt daemon.crit xinetd[2832]: 2832 {process_sensor} Adding 60.165.210.96 to the global_no_access list for 120 minutes Feb 1 05:16:00 cerowrt daemon.info dnsmasq-dhcp[2896]: RTR-ADVERT(se00) 2001:470:89c6:: Feb 1 05:17:49 cerowrt daemon.info dnsmasq-dhcp[2896]: RTR-ADVERT(sw00) 2001:470:89c6:1:: Feb 1 05:19:38 cerowrt daemon.info hostapd: sw00: STA e0:75:7d:6c:67:de WPA: group key handshake completed (RSN) Feb 1 05:22:10 cerowrt daemon.info dnsmasq-dhcp[2896]: RTR-ADVERT(sw10) 2001:470:89c6:2:: Feb 1 05:25:36 cerowrt daemon.info dnsmasq-dhcp[2896]: RTR-ADVERT(se00) 2001:470:89c6:: Feb 1 05:26:55 cerowrt daemon.info dnsmasq-dhcp[2896]: RTR-ADVERT(sw00) 2001:470:89c6:1:: Feb 1 05:29:38 cerowrt daemon.info hostapd: sw00: STA e0:75:7d:6c:67:de WPA: group key handshake completed (RSN) Feb 1 05:29:44 cerowrt daemon.info dnsmasq-dhcp[2896]: RTR-ADVERT(sw10) 2001:470:89c6:2:: Feb 1 05:34:45 cerowrt daemon.info dnsmasq-dhcp[2896]: RTR-ADVERT(se00) 2001:470:89c6:: Feb 1 05:35:04 cerowrt daemon.info dnsmasq-dhcp[2896]: RTR-ADVERT(sw00) 2001:470:89c6:1:: Feb 1 05:37:35 cerowrt daemon.info dnsmasq-dhcp[2896]: RTR-ADVERT(sw10) 2001:470:89c6:2:: Feb 1 05:39:38 cerowrt daemon.info hostapd: sw00: STA e0:75:7d:6c:67:de WPA: group key handshake completed (RSN) Feb 1 05:43:33 cerowrt daemon.info dnsmasq-dhcp[2896]: RTR-ADVERT(sw00) 2001:470:89c6:1:: Feb 1 05:44:03 cerowrt daemon.info dnsmasq-dhcp[2896]: RTR-ADVERT(se00) 2001:470:89c6:: Feb 1 05:46:24 cerowrt daemon.info dnsmasq-dhcp[2896]: RTR-ADVERT(sw10) 2001:470:89c6:2:: Feb 1 05:49:38 cerowrt daemon.info hostapd: sw00: STA e0:75:7d:6c:67:de WPA: group key handshake completed (RSN) Feb 1 05:52:14 cerowrt daemon.info dnsmasq-dhcp[2896]: RTR-ADVERT(se00) 2001:470:89c6:: Feb 1 05:53:29 cerowrt daemon.info dnsmasq-dhcp[2896]: RTR-ADVERT(sw00) 2001:470:89c6:1:: Feb 1 05:55:50 cerowrt daemon.info dnsmasq-dhcp[2896]: RTR-ADVERT(sw10) 2001:470:89c6:2:: Feb 1 05:58:48 cerowrt daemon.info xinetd[2832]: At least 1 DENY_TIME has expired, global_no_access list updated Feb 1 05:59:38 cerowrt daemon.info hostapd: sw00: STA e0:75:7d:6c:67:de WPA: group key handshake completed (RSN) Feb 1 06:00:20 cerowrt daemon.info dnsmasq-dhcp[2896]: RTR-ADVERT(se00) 2001:470:89c6:: Feb 1 06:03:02 cerowrt daemon.info dnsmasq-dhcp[2896]: RTR-ADVERT(sw00) 2001:470:89c6:1:: Feb 1 06:04:52 cerowrt daemon.info dnsmasq-dhcp[2896]: RTR-ADVERT(sw10) 2001:470:89c6:2:: Feb 1 06:08:20 cerowrt daemon.info dnsmasq-dhcp[2896]: RTR-ADVERT(se00) 2001:470:89c6:: Feb 1 06:09:38 cerowrt daemon.info hostapd: sw00: STA e0:75:7d:6c:67:de WPA: group key handshake completed (RSN) Feb 1 06:11:32 cerowrt daemon.info dnsmasq-dhcp[2896]: RTR-ADVERT(sw00) 2001:470:89c6:1:: Feb 1 06:12:22 cerowrt daemon.crit xinetd[2832]: 2832 {process_sensor} Adding 71.187.187.196 to the global_no_access list for 120 minutes Feb 1 06:13:23 cerowrt daemon.info dnsmasq-dhcp[2896]: RTR-ADVERT(sw10) 2001:470:89c6:2:: Feb 1 06:18:19 cerowrt daemon.info dnsmasq-dhcp[2896]: RTR-ADVERT(se00) 2001:470:89c6:: Feb 1 06:19:38 cerowrt daemon.info hostapd: sw00: STA e0:75:7d:6c:67:de WPA: group key handshake completed (RSN) Feb 1 06:21:03 cerowrt daemon.info dnsmasq-dhcp[2896]: RTR-ADVERT(sw10) 2001:470:89c6:2:: Feb 1 06:21:21 cerowrt daemon.info dnsmasq-dhcp[2896]: RTR-ADVERT(sw00) 2001:470:89c6:1:: Feb 1 06:24:12 cerowrt kern.info kernel: [5030779.328125] ge00: link down Feb 1 06:24:16 cerowrt kern.debug kernel: [5030783.343750] ar71xx: pll_reg 0xb8050014: 0x11110000 Feb 1 06:24:16 cerowrt kern.info kernel: [5030783.343750] ge00: link up (1000Mbps/Full duplex) Feb 1 06:24:30 cerowrt kern.info kernel: [5030797.406250] ge00: link down Feb 1 06:24:55 cerowrt kern.debug kernel: [5030822.503906] ar71xx: pll_reg 0xb8050014: 0x11110000 Feb 1 06:24:55 cerowrt kern.info kernel: [5030822.503906] ge00: link up (1000Mbps/Full duplex) Feb 1 06:27:56 cerowrt daemon.info dnsmasq-dhcp[2896]: RTR-ADVERT(se00) 2001:470:89c6:: Feb 1 06:29:14 cerowrt daemon.info dnsmasq-dhcp[2896]: RTR-ADVERT(sw10) 2001:470:89c6:2:: Feb 1 06:29:38 cerowrt daemon.info hostapd: sw00: STA e0:75:7d:6c:67:de WPA: group key handshake completed (RSN) Feb 1 06:31:07 cerowrt daemon.info dnsmasq-dhcp[2896]: RTR-ADVERT(sw00) 2001:470:89c6:1:: Feb 1 06:36:39 cerowrt daemon.info dnsmasq-dhcp[2896]: RTR-ADVERT(se00) 2001:470:89c6:: Feb 1 06:38:47 cerowrt daemon.info dnsmasq-dhcp[2896]: RTR-ADVERT(sw00) 2001:470:89c6:1:: Feb 1 06:38:55 cerowrt daemon.info dnsmasq-dhcp[2896]: RTR-ADVERT(sw10) 2001:470:89c6:2:: Feb 1 06:39:38 cerowrt daemon.info hostapd: sw00: STA e0:75:7d:6c:67:de WPA: group key handshake completed (RSN) Feb 1 06:44:26 cerowrt daemon.info dnsmasq-dhcp[2896]: RTR-ADVERT(se00) 2001:470:89c6:: Feb 1 06:46:36 cerowrt daemon.info dnsmasq-dhcp[2896]: RTR-ADVERT(sw10) 2001:470:89c6:2:: Feb 1 06:47:26 cerowrt daemon.info dnsmasq-dhcp[2896]: RTR-ADVERT(sw00) 2001:470:89c6:1:: Feb 1 06:49:38 cerowrt daemon.info hostapd: sw00: STA e0:75:7d:6c:67:de WPA: group key handshake completed (RSN) Feb 1 06:52:47 cerowrt daemon.info dnsmasq-dhcp[2896]: RTR-ADVERT(se00) 2001:470:89c6:: Feb 1 06:54:47 cerowrt daemon.info dnsmasq-dhcp[2896]: RTR-ADVERT(sw10) 2001:470:89c6:2:: Feb 1 06:56:36 cerowrt daemon.info dnsmasq-dhcp[2896]: RTR-ADVERT(sw00) 2001:470:89c6:1:: Feb 1 06:59:00 cerowrt daemon.crit xinetd[2832]: 2832 {process_sensor} Adding 187.54.249.118 to the global_no_access list for 120 minutes Feb 1 06:59:38 cerowrt daemon.info hostapd: sw00: STA e0:75:7d:6c:67:de WPA: group key handshake completed (RSN) Feb 1 07:02:03 cerowrt daemon.info dnsmasq-dhcp[2896]: RTR-ADVERT(se00) 2001:470:89c6:: Feb 1 07:02:53 cerowrt daemon.info dnsmasq-dhcp[2896]: RTR-ADVERT(sw10) 2001:470:89c6:2:: Feb 1 07:05:08 cerowrt daemon.info dnsmasq-dhcp[2896]: RTR-ADVERT(sw00) 2001:470:89c6:1:: Feb 1 07:07:25 cerowrt daemon.crit xinetd[2832]: 2832 {process_sensor} Adding 181.50.13.174 to the global_no_access list for 120 minutes Feb 1 07:09:38 cerowrt daemon.info hostapd: sw00: STA e0:75:7d:6c:67:de WPA: group key handshake completed (RSN) Feb 1 07:11:33 cerowrt daemon.info dnsmasq-dhcp[2896]: RTR-ADVERT(se00) 2001:470:89c6:: Feb 1 07:11:35 cerowrt daemon.info dnsmasq-dhcp[2896]: RTR-ADVERT(sw10) 2001:470:89c6:2:: Feb 1 07:13:52 cerowrt daemon.info xinetd[2832]: At least 1 DENY_TIME has expired, global_no_access list updated Feb 1 07:14:12 cerowrt daemon.info dnsmasq-dhcp[2896]: RTR-ADVERT(sw00) 2001:470:89c6:1:: Feb 1 07:19:38 cerowrt daemon.info hostapd: sw00: STA e0:75:7d:6c:67:de WPA: group key handshake completed (RSN) Feb 1 07:20:09 cerowrt daemon.info dnsmasq-dhcp[2896]: RTR-ADVERT(sw10) 2001:470:89c6:2:: Feb 1 07:20:30 cerowrt daemon.info dnsmasq-dhcp[2896]: RTR-ADVERT(se00) 2001:470:89c6:: Feb 1 07:23:36 cerowrt daemon.info dnsmasq-dhcp[2896]: RTR-ADVERT(sw00) 2001:470:89c6:1:: Feb 1 07:24:57 cerowrt kern.info kernel: [5034424.527343] ge00: link down Feb 1 07:29:38 cerowrt daemon.info hostapd: sw00: STA e0:75:7d:6c:67:de WPA: group key handshake completed (RSN) Feb 1 07:29:41 cerowrt daemon.info dnsmasq-dhcp[2896]: RTR-ADVERT(se00) 2001:470:89c6:: Feb 1 07:29:50 cerowrt daemon.info dnsmasq-dhcp[2896]: RTR-ADVERT(sw10) 2001:470:89c6:2:: Feb 1 07:32:36 cerowrt daemon.info dnsmasq-dhcp[2896]: RTR-ADVERT(sw00) 2001:470:89c6:1:: Feb 1 07:38:52 cerowrt daemon.info dnsmasq-dhcp[2896]: RTR-ADVERT(se00) 2001:470:89c6:: Feb 1 07:39:12 cerowrt daemon.info hostapd: sw00: STA 74:e5:43:69:09:da IEEE 802.11: authenticated Feb 1 07:39:12 cerowrt daemon.info hostapd: sw00: STA 74:e5:43:69:09:da IEEE 802.11: associated (aid 2) Feb 1 07:39:12 cerowrt daemon.info hostapd: sw00: STA 74:e5:43:69:09:da RADIUS: starting accounting session 52806EEC-0000005B Feb 1 07:39:12 cerowrt daemon.info hostapd: sw00: STA 74:e5:43:69:09:da WPA: pairwise key handshake completed (RSN) Feb 1 07:39:12 cerowrt daemon.info dnsmasq-dhcp[2896]: DHCPDISCOVER(sw00) 172.30.42.74 74:e5:43:69:09:da Feb 1 07:39:12 cerowrt daemon.info dnsmasq-dhcp[2896]: DHCPOFFER(sw00) 172.30.42.74 74:e5:43:69:09:da Feb 1 07:39:12 cerowrt daemon.info dnsmasq-dhcp[2896]: DHCPREQUEST(sw00) 172.30.42.74 74:e5:43:69:09:da Feb 1 07:39:12 cerowrt daemon.info dnsmasq-dhcp[2896]: DHCPACK(sw00) 172.30.42.74 74:e5:43:69:09:da a Feb 1 07:39:12 cerowrt daemon.info dnsmasq-dhcp[2896]: RTR-ADVERT(sw00) 2001:470:89c6:1:: Feb 1 07:39:13 cerowrt daemon.info dnsmasq-dhcp[2896]: RTR-SOLICIT(sw00) 74:e5:43:69:09:da Feb 1 07:39:13 cerowrt daemon.info dnsmasq-dhcp[2896]: RTR-ADVERT(sw00) 2001:470:89c6:1:: Feb 1 07:39:14 cerowrt daemon.info dnsmasq-dhcp[2896]: SLAAC-CONFIRM(sw00) 2001:470:89c6:1:76e5:43ff:fe69:9da a Feb 1 07:39:15 cerowrt daemon.info dnsmasq-dhcp[2896]: DHCPINFORMATION-REQUEST(sw00) 00:04:fc:3a:bd:af:bb:b3:64:10:e1:fd:72:cf:0f:0c:c1:14 a Feb 1 07:39:19 cerowrt authpriv.info dropbear[3709]: Child connection from 172.30.42.74:53620 Feb 1 07:39:20 cerowrt daemon.info dnsmasq-dhcp[2896]: RTR-ADVERT(sw00) 2001:470:89c6:1:: Feb 1 07:39:25 cerowrt authpriv.info dropbear[3709]: Exit before auth: Exited normally Feb 1 07:39:28 cerowrt authpriv.info dropbear[3710]: Child connection from 172.30.42.74:53621 Feb 1 07:39:35 cerowrt authpriv.warn dropbear[3710]: Login attempt for nonexistent user from 172.30.42.74:53621 Feb 1 07:39:37 cerowrt daemon.info dnsmasq-dhcp[2896]: RTR-ADVERT(sw00) 2001:470:89c6:1:: Feb 1 07:39:38 cerowrt daemon.info hostapd: sw00: STA 74:e5:43:69:09:da WPA: group key handshake completed (RSN) Feb 1 07:39:38 cerowrt daemon.info hostapd: sw00: STA e0:75:7d:6c:67:de WPA: group key handshake completed (RSN) Feb 1 07:39:39 cerowrt authpriv.warn dropbear[3710]: Login attempt for nonexistent user from 172.30.42.74:53621 Feb 1 07:39:44 cerowrt authpriv.warn dropbear[3710]: Login attempt for nonexistent user from 172.30.42.74:53621 Feb 1 07:39:44 cerowrt authpriv.info dropbear[3710]: Exit before auth: Exited normally Feb 1 07:39:45 cerowrt daemon.info dnsmasq-dhcp[2896]: RTR-ADVERT(sw10) 2001:470:89c6:2:: Feb 1 07:39:52 cerowrt kern.debug kernel: [5035318.730468] icmpv6_send: no reply to icmp error Feb 1 07:39:55 cerowrt daemon.info dnsmasq-dhcp[2896]: RTR-ADVERT(sw00) 2001:470:89c6:1:: Feb 1 07:39:56 cerowrt kern.debug kernel: [5035322.816406] icmpv6_send: no reply to icmp error Feb 1 07:40:00 cerowrt kern.debug kernel: [5035327.488281] icmpv6_send: no reply to icmp error Feb 1 07:40:07 cerowrt authpriv.info dropbear[3712]: Child connection from 172.30.42.74:53629 Feb 1 07:40:10 cerowrt kern.debug kernel: [5035336.816406] icmpv6_send: no reply to icmp error Feb 1 07:40:13 cerowrt daemon.info dnsmasq-dhcp[2896]: RTR-ADVERT(sw00) 2001:470:89c6:1:: Feb 1 07:40:13 cerowrt authpriv.notice dropbear[3712]: Password auth succeeded for 'root' from 172.30.42.74:53629 Feb 1 07:40:28 cerowrt kern.debug kernel: [5035355.472656] icmpv6_send: no reply to icmp error Feb 1 07:40:43 cerowrt kern.info kernel: [5035370.363281] device ge00 entered promiscuous mode Feb 1 07:40:44 cerowrt kern.info kernel: [5035371.164062] device ge00 left promiscuous mode Feb 1 07:40:46 cerowrt kern.info kernel: [5035372.847656] device ge00 entered promiscuous mode Feb 1 07:40:49 cerowrt kern.info kernel: [5035376.109375] device ge00 left promiscuous mode Feb 1 07:46:37 cerowrt daemon.info dnsmasq-dhcp[2896]: RTR-ADVERT(se00) 2001:470:89c6:: --d6Gm4EdcadzBjdND--