[Cerowrt-devel] odhcp6c went crazy flooding Comcast with DHCPv6 SOLICITs
Chuck Anderson
cra at WPI.EDU
Sat Feb 1 08:29:50 EST 2014
This morning my Linux PC which has a direct connection to my Comcast
cable modem (no router in between) lost its IPv4 address. During
troubleshooting, I noticed that the dhclient was unable to get an IPv4
address from Comcast. I ran tcpdump and discovered that the CeroWRT
router, also connected to the same cable modem via a switch, was
flooding the WAN with DHCPv6 SOLICIT packets with about 4700
packets/sec, 6.6 megabits/sec of traffic! I immediately unplugged
CeroWRT from the WAN and then my PC was able to get an IPv4 address
from Comcast.
I know CeroWrt 3.7.5-2 is old at this point, but I'm wondering if
something else changed to cause this behavior. Maybe Comcast
IPv6-enabled my CMTS finally? I've been using HE tunnels for IPv6,
one on a Linksys OpenWRT for my "production" network and a separate
tunnel on this CeroWRT for "testing".
There is one other change that was made to my Linux PC--I booted into
a new kernel yesterday morning and had a similar problem with the
inability to get an IPv4 address via DHCP from Comcast for about 30
minutes, then it just started working on its own. (I hadn't noticed
initially since I was using IPv6 to get where I needed to go.) I
didn't have time to troubleshoot it at the time, but I assumed it was
due to this IPv6 change in the Fedora kernel:
* Wed Jan 29 2014 Justin M. Forbes <jforbes at fedoraproject.org> - 3.12.9-201
- ipv6 addrconf: revert /proc/net/if_inet6 ifa_flag format (rhbz 1056711)
* Tue Jan 28 2014 Josh Boyer <jwboyer at fedoraproject.org>
- Add patch from Stanislaw Gruszka to fix ath9k BUG (rhbz 990955)
* Mon Jan 27 2014 Justin M. Forbes <jforbes at fedoraproject.org> - 3.12.9-200
- Backport new IPv6 address flag IFA_F_NOPREFIXROUTE and IFA_F_MANAGETEMPADDR (rhbz 1056711)
- Linux v3.12.9
- i915: remove pm_qos request on error (rhbz 1057533)
See https://bugzilla.redhat.com/show_bug.cgi?id=1056711 for details
about that.
Each time this loss of IPv4 happened, I noticed the NIC link went down
right before it started. Maybe the flooding was happening yesterday
morning too, and the flooding caused my poor 5-port Netgear switch to
flake out and flap the NIC links? Alternatively, maybe the link flap
itself was what caused odhcp6c to wig out and start flooding in the
first place? Unfortunately I don't have a tcpdump from yesterday
morning to confirm this.
CeroWRT status:
Router Name cerowrt
Router Model NETGEAR WNDR3700v2
Firmware Version CeroWrt Modena 3.7.5-2 / LuCI Trunk (trunk+svn)
Kernel Version 3.7.5
Local Time Sat Feb 1 07:54:43 2014
Uptime 58d 6h 56m 51s
The DHCPv6 client is odhcp6c:
root at cerowrt:~# ps |grep dhc
980 root 1720 S udhcpc -p /var/run/udhcpc-ge00.pid -s /lib/netifd/dh
1335 root 804 R odhcp6c -s /lib/netifd/dhcpv6.script -Ntry -P60 ge00
3725 root 1704 S grep dhc
Here is an example packet from the DHCPv6 flood:
No. Time Source Destination Protocol Length Info
1 0.000000 fe80::c63d:c7ff:feb0:8f41 ff02::1:2 DHCPv6 179 Solicit XID: 0x45eb91 CID: 00030001c43dc7b08f41
Frame 1: 179 bytes on wire (1432 bits), 179 bytes captured (1432 bits)
Encapsulation type: Ethernet (1)
Arrival Time: Feb 1, 2014 07:20:27.723633000 EST
[Time shift for this packet: 0.000000000 seconds]
Epoch Time: 1391257227.723633000 seconds
[Time delta from previous captured frame: 0.000000000 seconds]
[Time delta from previous displayed frame: 0.000000000 seconds]
[Time since reference or first frame: 0.000000000 seconds]
Frame Number: 1
Frame Length: 179 bytes (1432 bits)
Capture Length: 179 bytes (1432 bits)
[Frame is marked: False]
[Frame is ignored: False]
[Protocols in frame: eth:ipv6:udp:dhcpv6]
[Coloring Rule Name: UDP]
[Coloring Rule String: udp]
Ethernet II, Src: Netgear_b0:8f:41 (c4:3d:c7:b0:8f:41), Dst: IPv6mcast_00:01:00:02 (33:33:00:01:00:02)
Destination: IPv6mcast_00:01:00:02 (33:33:00:01:00:02)
Address: IPv6mcast_00:01:00:02 (33:33:00:01:00:02)
.... ..1. .... .... .... .... = LG bit: Locally administered address (this is NOT the factory default)
.... ...1 .... .... .... .... = IG bit: Group address (multicast/broadcast)
Source: Netgear_b0:8f:41 (c4:3d:c7:b0:8f:41)
Address: Netgear_b0:8f:41 (c4:3d:c7:b0:8f:41)
.... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
.... ...0 .... .... .... .... = IG bit: Individual address (unicast)
Type: IPv6 (0x86dd)
Internet Protocol Version 6, Src: fe80::c63d:c7ff:feb0:8f41 (fe80::c63d:c7ff:feb0:8f41), Dst: ff02::1:2 (ff02::1:2)
0110 .... = Version: 6
[0110 .... = This field makes the filter "ip.version == 6" possible: 6]
.... 0000 0000 .... .... .... .... .... = Traffic class: 0x00000000
.... 0000 00.. .... .... .... .... .... = Differentiated Services Field: Default (0x00000000)
.... .... ..0. .... .... .... .... .... = ECN-Capable Transport (ECT): Not set
.... .... ...0 .... .... .... .... .... = ECN-CE: Not set
.... .... .... 0000 0000 0000 0000 0000 = Flowlabel: 0x00000000
Payload length: 125
Next header: UDP (17)
Hop limit: 1
Source: fe80::c63d:c7ff:feb0:8f41 (fe80::c63d:c7ff:feb0:8f41)
[Source SA MAC: Netgear_b0:8f:41 (c4:3d:c7:b0:8f:41)]
Destination: ff02::1:2 (ff02::1:2)
[Source GeoIP: Unknown]
[Destination GeoIP: Unknown]
User Datagram Protocol, Src Port: dhcpv6-client (546), Dst Port: dhcpv6-server (547)
Source port: dhcpv6-client (546)
Destination port: dhcpv6-server (547)
Length: 125
Checksum: 0xda1c [validation disabled]
[Good Checksum: False]
[Bad Checksum: False]
DHCPv6
Message type: Solicit (1)
Transaction ID: 0x45eb91
Elapsed time
Option: Elapsed time (8)
Length: 2
Value: ffff
Elapsed-time: 655350 ms
Option Request
Option: Option Request (6)
Length: 10
Value: 00170018003800160015
Requested Option code: DNS recursive name server (23)
Requested Option code: Domain Search List (24)
Requested Option code: Unknown (56)
Requested Option code: SIP Servers IPv6 Address List (22)
Requested Option code: SIP Server Domain Name List (21)
Client Identifier
Option: Client Identifier (1)
Length: 10
Value: 00030001c43dc7b08f41
DUID: 00030001c43dc7b08f41
DUID Type: link-layer address (3)
Hardware type: Ethernet (1)
Link-layer address: c4:3d:c7:b0:8f:41
Reconfigure Accept
Option: Reconfigure Accept (20)
Length: 0
Fully Qualified Domain Name
Option: Fully Qualified Domain Name (39)
Length: 10
Value: 00076365726f77727400
0000 0... = Reserved: 0x00
.... .0.. = N bit: Server should perform DNS updates
.... ..0. = O bit: Server has not overridden client's S bit preference
.... ...0 = S bit: Server should not perform forward DNS updates
Domain: cerowrt
Identity Association for Non-temporary Address
Option: Identity Association for Non-temporary Address (3)
Length: 12
Value: 000000010000000000000000
IAID: 00000001
T1: 0
T2: 0
Identity Association for Prefix Delegation
Option: Identity Association for Prefix Delegation (25)
Length: 41
Value: 000000010000000000000000001a00190000000000000000...
IAID: 00000001
T1: 0
T2: 0
IA Prefix
Option: IA Prefix (26)
Length: 25
Value: 00000000000000003c000000000000000000000000000000...
Preferred lifetime: 0
Valid lifetime: 0
Prefix length: 60
Prefix address: :: (::)
0000 33 33 00 01 00 02 c4 3d c7 b0 8f 41 86 dd 60 00 33.....=...A..`.
0010 00 00 00 7d 11 01 fe 80 00 00 00 00 00 00 c6 3d ...}...........=
0020 c7 ff fe b0 8f 41 ff 02 00 00 00 00 00 00 00 00 .....A..........
0030 00 00 00 01 00 02 02 22 02 23 00 7d da 1c 01 45 .......".#.}...E
0040 eb 91 00 08 00 02 ff ff 00 06 00 0a 00 17 00 18 ................
0050 00 38 00 16 00 15 00 01 00 0a 00 03 00 01 c4 3d .8.............=
0060 c7 b0 8f 41 00 14 00 00 00 27 00 0a 00 07 63 65 ...A.....'....ce
0070 72 6f 77 72 74 00 00 03 00 0c 00 00 00 01 00 00 rowrt...........
0080 00 00 00 00 00 00 00 19 00 29 00 00 00 01 00 00 .........)......
0090 00 00 00 00 00 00 00 1a 00 19 00 00 00 00 00 00 ................
00a0 00 00 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 ..<.............
00b0 00 00 00 ...
The CeroWRT system log is attached. Nothing looks strange except the
loss of ge00 link around 6:24 this morning, which is right around when
I lost IPv4 connectivity to my Linux PC (I have a system monitoring
this IP and it SMS's me if it goes down). My PC's NIC link went down
at exactly the same time. At 7:24 is when I unplugged CeroWRT.
-------------- next part --------------
Feb 1 03:44:30 cerowrt daemon.info dnsmasq-dhcp[2896]: RTR-ADVERT(sw10) 2001:470:89c6:2::
Feb 1 03:47:19 cerowrt daemon.info dnsmasq-dhcp[2896]: RTR-ADVERT(se00) 2001:470:89c6::
Feb 1 03:49:38 cerowrt daemon.info hostapd: sw00: STA e0:75:7d:6c:67:de WPA: group key handshake completed (RSN)
Feb 1 03:50:22 cerowrt daemon.info dnsmasq-dhcp[2896]: RTR-ADVERT(sw00) 2001:470:89c6:1::
Feb 1 03:53:35 cerowrt daemon.info dnsmasq-dhcp[2896]: RTR-ADVERT(sw10) 2001:470:89c6:2::
Feb 1 03:56:41 cerowrt daemon.info xinetd[2832]: At least 1 DENY_TIME has expired, global_no_access list updated
Feb 1 03:57:04 cerowrt daemon.info dnsmasq-dhcp[2896]: RTR-ADVERT(se00) 2001:470:89c6::
Feb 1 03:58:00 cerowrt daemon.crit xinetd[2832]: 2832 {process_sensor} Adding 88.119.198.49 to the global_no_access list for 120 minutes
Feb 1 03:58:28 cerowrt daemon.crit xinetd[2832]: 2832 {process_sensor} Adding 58.63.69.150 to the global_no_access list for 120 minutes
Feb 1 03:59:08 cerowrt daemon.info dnsmasq-dhcp[2896]: RTR-ADVERT(sw00) 2001:470:89c6:1::
Feb 1 03:59:38 cerowrt daemon.info hostapd: sw00: STA e0:75:7d:6c:67:de WPA: group key handshake completed (RSN)
Feb 1 03:59:42 cerowrt daemon.info xinetd[2832]: At least 1 DENY_TIME has expired, global_no_access list updated
Feb 1 04:02:32 cerowrt daemon.info dnsmasq-dhcp[2896]: RTR-ADVERT(sw10) 2001:470:89c6:2::
Feb 1 04:06:00 cerowrt daemon.info dnsmasq-dhcp[2896]: RTR-ADVERT(se00) 2001:470:89c6::
Feb 1 04:08:47 cerowrt daemon.info dnsmasq-dhcp[2896]: RTR-ADVERT(sw00) 2001:470:89c6:1::
Feb 1 04:09:38 cerowrt daemon.info hostapd: sw00: STA e0:75:7d:6c:67:de WPA: group key handshake completed (RSN)
Feb 1 04:11:20 cerowrt daemon.info dnsmasq-dhcp[2896]: RTR-ADVERT(sw10) 2001:470:89c6:2::
Feb 1 04:13:56 cerowrt daemon.info dnsmasq-dhcp[2896]: RTR-ADVERT(se00) 2001:470:89c6::
Feb 1 04:18:43 cerowrt daemon.info dnsmasq-dhcp[2896]: RTR-ADVERT(sw00) 2001:470:89c6:1::
Feb 1 04:19:38 cerowrt daemon.info hostapd: sw00: STA e0:75:7d:6c:67:de WPA: group key handshake completed (RSN)
Feb 1 04:20:12 cerowrt daemon.info dnsmasq-dhcp[2896]: RTR-ADVERT(sw10) 2001:470:89c6:2::
Feb 1 04:21:43 cerowrt daemon.info xinetd[2832]: At least 1 DENY_TIME has expired, global_no_access list updated
Feb 1 04:22:12 cerowrt daemon.info dnsmasq-dhcp[2896]: RTR-ADVERT(se00) 2001:470:89c6::
Feb 1 04:28:35 cerowrt daemon.info dnsmasq-dhcp[2896]: RTR-ADVERT(sw00) 2001:470:89c6:1::
Feb 1 04:29:14 cerowrt daemon.info dnsmasq-dhcp[2896]: RTR-ADVERT(sw10) 2001:470:89c6:2::
Feb 1 04:29:38 cerowrt daemon.info hostapd: sw00: STA e0:75:7d:6c:67:de WPA: group key handshake completed (RSN)
Feb 1 04:31:12 cerowrt daemon.info dnsmasq-dhcp[2896]: RTR-ADVERT(se00) 2001:470:89c6::
Feb 1 04:32:44 cerowrt daemon.info xinetd[2832]: At least 1 DENY_TIME has expired, global_no_access list updated
Feb 1 04:36:44 cerowrt daemon.info dnsmasq-dhcp[2896]: RTR-ADVERT(sw00) 2001:470:89c6:1::
Feb 1 04:38:16 cerowrt daemon.info dnsmasq-dhcp[2896]: RTR-ADVERT(sw10) 2001:470:89c6:2::
Feb 1 04:39:38 cerowrt daemon.info hostapd: sw00: STA e0:75:7d:6c:67:de WPA: group key handshake completed (RSN)
Feb 1 04:39:44 cerowrt daemon.info xinetd[2832]: At least 1 DENY_TIME has expired, global_no_access list updated
Feb 1 04:41:10 cerowrt daemon.info dnsmasq-dhcp[2896]: RTR-ADVERT(se00) 2001:470:89c6::
Feb 1 04:44:21 cerowrt daemon.info dnsmasq-dhcp[2896]: RTR-ADVERT(sw00) 2001:470:89c6:1::
Feb 1 04:47:58 cerowrt daemon.info dnsmasq-dhcp[2896]: RTR-ADVERT(sw10) 2001:470:89c6:2::
Feb 1 04:49:38 cerowrt daemon.info hostapd: sw00: STA e0:75:7d:6c:67:de WPA: group key handshake completed (RSN)
Feb 1 04:50:43 cerowrt daemon.info dnsmasq-dhcp[2896]: RTR-ADVERT(se00) 2001:470:89c6::
Feb 1 04:53:37 cerowrt daemon.info dnsmasq-dhcp[2896]: RTR-ADVERT(sw00) 2001:470:89c6:1::
Feb 1 04:56:01 cerowrt daemon.info dnsmasq-dhcp[2896]: RTR-ADVERT(sw10) 2001:470:89c6:2::
Feb 1 04:57:45 cerowrt daemon.info xinetd[2832]: At least 1 DENY_TIME has expired, global_no_access list updated
Feb 1 04:58:14 cerowrt daemon.info dnsmasq-dhcp[2896]: RTR-ADVERT(se00) 2001:470:89c6::
Feb 1 04:59:38 cerowrt daemon.info hostapd: sw00: STA e0:75:7d:6c:67:de WPA: group key handshake completed (RSN)
Feb 1 05:01:41 cerowrt daemon.info dnsmasq-dhcp[2896]: RTR-ADVERT(sw00) 2001:470:89c6:1::
Feb 1 05:04:28 cerowrt daemon.info dnsmasq-dhcp[2896]: RTR-ADVERT(sw10) 2001:470:89c6:2::
Feb 1 05:07:24 cerowrt daemon.info dnsmasq-dhcp[2896]: RTR-ADVERT(se00) 2001:470:89c6::
Feb 1 05:09:38 cerowrt daemon.info hostapd: sw00: STA e0:75:7d:6c:67:de WPA: group key handshake completed (RSN)
Feb 1 05:09:54 cerowrt daemon.info dnsmasq-dhcp[2896]: RTR-ADVERT(sw00) 2001:470:89c6:1::
Feb 1 05:13:36 cerowrt daemon.info dnsmasq-dhcp[2896]: RTR-ADVERT(sw10) 2001:470:89c6:2::
Feb 1 05:13:40 cerowrt daemon.crit xinetd[2832]: 2832 {process_sensor} Adding 60.165.210.96 to the global_no_access list for 120 minutes
Feb 1 05:16:00 cerowrt daemon.info dnsmasq-dhcp[2896]: RTR-ADVERT(se00) 2001:470:89c6::
Feb 1 05:17:49 cerowrt daemon.info dnsmasq-dhcp[2896]: RTR-ADVERT(sw00) 2001:470:89c6:1::
Feb 1 05:19:38 cerowrt daemon.info hostapd: sw00: STA e0:75:7d:6c:67:de WPA: group key handshake completed (RSN)
Feb 1 05:22:10 cerowrt daemon.info dnsmasq-dhcp[2896]: RTR-ADVERT(sw10) 2001:470:89c6:2::
Feb 1 05:25:36 cerowrt daemon.info dnsmasq-dhcp[2896]: RTR-ADVERT(se00) 2001:470:89c6::
Feb 1 05:26:55 cerowrt daemon.info dnsmasq-dhcp[2896]: RTR-ADVERT(sw00) 2001:470:89c6:1::
Feb 1 05:29:38 cerowrt daemon.info hostapd: sw00: STA e0:75:7d:6c:67:de WPA: group key handshake completed (RSN)
Feb 1 05:29:44 cerowrt daemon.info dnsmasq-dhcp[2896]: RTR-ADVERT(sw10) 2001:470:89c6:2::
Feb 1 05:34:45 cerowrt daemon.info dnsmasq-dhcp[2896]: RTR-ADVERT(se00) 2001:470:89c6::
Feb 1 05:35:04 cerowrt daemon.info dnsmasq-dhcp[2896]: RTR-ADVERT(sw00) 2001:470:89c6:1::
Feb 1 05:37:35 cerowrt daemon.info dnsmasq-dhcp[2896]: RTR-ADVERT(sw10) 2001:470:89c6:2::
Feb 1 05:39:38 cerowrt daemon.info hostapd: sw00: STA e0:75:7d:6c:67:de WPA: group key handshake completed (RSN)
Feb 1 05:43:33 cerowrt daemon.info dnsmasq-dhcp[2896]: RTR-ADVERT(sw00) 2001:470:89c6:1::
Feb 1 05:44:03 cerowrt daemon.info dnsmasq-dhcp[2896]: RTR-ADVERT(se00) 2001:470:89c6::
Feb 1 05:46:24 cerowrt daemon.info dnsmasq-dhcp[2896]: RTR-ADVERT(sw10) 2001:470:89c6:2::
Feb 1 05:49:38 cerowrt daemon.info hostapd: sw00: STA e0:75:7d:6c:67:de WPA: group key handshake completed (RSN)
Feb 1 05:52:14 cerowrt daemon.info dnsmasq-dhcp[2896]: RTR-ADVERT(se00) 2001:470:89c6::
Feb 1 05:53:29 cerowrt daemon.info dnsmasq-dhcp[2896]: RTR-ADVERT(sw00) 2001:470:89c6:1::
Feb 1 05:55:50 cerowrt daemon.info dnsmasq-dhcp[2896]: RTR-ADVERT(sw10) 2001:470:89c6:2::
Feb 1 05:58:48 cerowrt daemon.info xinetd[2832]: At least 1 DENY_TIME has expired, global_no_access list updated
Feb 1 05:59:38 cerowrt daemon.info hostapd: sw00: STA e0:75:7d:6c:67:de WPA: group key handshake completed (RSN)
Feb 1 06:00:20 cerowrt daemon.info dnsmasq-dhcp[2896]: RTR-ADVERT(se00) 2001:470:89c6::
Feb 1 06:03:02 cerowrt daemon.info dnsmasq-dhcp[2896]: RTR-ADVERT(sw00) 2001:470:89c6:1::
Feb 1 06:04:52 cerowrt daemon.info dnsmasq-dhcp[2896]: RTR-ADVERT(sw10) 2001:470:89c6:2::
Feb 1 06:08:20 cerowrt daemon.info dnsmasq-dhcp[2896]: RTR-ADVERT(se00) 2001:470:89c6::
Feb 1 06:09:38 cerowrt daemon.info hostapd: sw00: STA e0:75:7d:6c:67:de WPA: group key handshake completed (RSN)
Feb 1 06:11:32 cerowrt daemon.info dnsmasq-dhcp[2896]: RTR-ADVERT(sw00) 2001:470:89c6:1::
Feb 1 06:12:22 cerowrt daemon.crit xinetd[2832]: 2832 {process_sensor} Adding 71.187.187.196 to the global_no_access list for 120 minutes
Feb 1 06:13:23 cerowrt daemon.info dnsmasq-dhcp[2896]: RTR-ADVERT(sw10) 2001:470:89c6:2::
Feb 1 06:18:19 cerowrt daemon.info dnsmasq-dhcp[2896]: RTR-ADVERT(se00) 2001:470:89c6::
Feb 1 06:19:38 cerowrt daemon.info hostapd: sw00: STA e0:75:7d:6c:67:de WPA: group key handshake completed (RSN)
Feb 1 06:21:03 cerowrt daemon.info dnsmasq-dhcp[2896]: RTR-ADVERT(sw10) 2001:470:89c6:2::
Feb 1 06:21:21 cerowrt daemon.info dnsmasq-dhcp[2896]: RTR-ADVERT(sw00) 2001:470:89c6:1::
Feb 1 06:24:12 cerowrt kern.info kernel: [5030779.328125] ge00: link down
Feb 1 06:24:16 cerowrt kern.debug kernel: [5030783.343750] ar71xx: pll_reg 0xb8050014: 0x11110000
Feb 1 06:24:16 cerowrt kern.info kernel: [5030783.343750] ge00: link up (1000Mbps/Full duplex)
Feb 1 06:24:30 cerowrt kern.info kernel: [5030797.406250] ge00: link down
Feb 1 06:24:55 cerowrt kern.debug kernel: [5030822.503906] ar71xx: pll_reg 0xb8050014: 0x11110000
Feb 1 06:24:55 cerowrt kern.info kernel: [5030822.503906] ge00: link up (1000Mbps/Full duplex)
Feb 1 06:27:56 cerowrt daemon.info dnsmasq-dhcp[2896]: RTR-ADVERT(se00) 2001:470:89c6::
Feb 1 06:29:14 cerowrt daemon.info dnsmasq-dhcp[2896]: RTR-ADVERT(sw10) 2001:470:89c6:2::
Feb 1 06:29:38 cerowrt daemon.info hostapd: sw00: STA e0:75:7d:6c:67:de WPA: group key handshake completed (RSN)
Feb 1 06:31:07 cerowrt daemon.info dnsmasq-dhcp[2896]: RTR-ADVERT(sw00) 2001:470:89c6:1::
Feb 1 06:36:39 cerowrt daemon.info dnsmasq-dhcp[2896]: RTR-ADVERT(se00) 2001:470:89c6::
Feb 1 06:38:47 cerowrt daemon.info dnsmasq-dhcp[2896]: RTR-ADVERT(sw00) 2001:470:89c6:1::
Feb 1 06:38:55 cerowrt daemon.info dnsmasq-dhcp[2896]: RTR-ADVERT(sw10) 2001:470:89c6:2::
Feb 1 06:39:38 cerowrt daemon.info hostapd: sw00: STA e0:75:7d:6c:67:de WPA: group key handshake completed (RSN)
Feb 1 06:44:26 cerowrt daemon.info dnsmasq-dhcp[2896]: RTR-ADVERT(se00) 2001:470:89c6::
Feb 1 06:46:36 cerowrt daemon.info dnsmasq-dhcp[2896]: RTR-ADVERT(sw10) 2001:470:89c6:2::
Feb 1 06:47:26 cerowrt daemon.info dnsmasq-dhcp[2896]: RTR-ADVERT(sw00) 2001:470:89c6:1::
Feb 1 06:49:38 cerowrt daemon.info hostapd: sw00: STA e0:75:7d:6c:67:de WPA: group key handshake completed (RSN)
Feb 1 06:52:47 cerowrt daemon.info dnsmasq-dhcp[2896]: RTR-ADVERT(se00) 2001:470:89c6::
Feb 1 06:54:47 cerowrt daemon.info dnsmasq-dhcp[2896]: RTR-ADVERT(sw10) 2001:470:89c6:2::
Feb 1 06:56:36 cerowrt daemon.info dnsmasq-dhcp[2896]: RTR-ADVERT(sw00) 2001:470:89c6:1::
Feb 1 06:59:00 cerowrt daemon.crit xinetd[2832]: 2832 {process_sensor} Adding 187.54.249.118 to the global_no_access list for 120 minutes
Feb 1 06:59:38 cerowrt daemon.info hostapd: sw00: STA e0:75:7d:6c:67:de WPA: group key handshake completed (RSN)
Feb 1 07:02:03 cerowrt daemon.info dnsmasq-dhcp[2896]: RTR-ADVERT(se00) 2001:470:89c6::
Feb 1 07:02:53 cerowrt daemon.info dnsmasq-dhcp[2896]: RTR-ADVERT(sw10) 2001:470:89c6:2::
Feb 1 07:05:08 cerowrt daemon.info dnsmasq-dhcp[2896]: RTR-ADVERT(sw00) 2001:470:89c6:1::
Feb 1 07:07:25 cerowrt daemon.crit xinetd[2832]: 2832 {process_sensor} Adding 181.50.13.174 to the global_no_access list for 120 minutes
Feb 1 07:09:38 cerowrt daemon.info hostapd: sw00: STA e0:75:7d:6c:67:de WPA: group key handshake completed (RSN)
Feb 1 07:11:33 cerowrt daemon.info dnsmasq-dhcp[2896]: RTR-ADVERT(se00) 2001:470:89c6::
Feb 1 07:11:35 cerowrt daemon.info dnsmasq-dhcp[2896]: RTR-ADVERT(sw10) 2001:470:89c6:2::
Feb 1 07:13:52 cerowrt daemon.info xinetd[2832]: At least 1 DENY_TIME has expired, global_no_access list updated
Feb 1 07:14:12 cerowrt daemon.info dnsmasq-dhcp[2896]: RTR-ADVERT(sw00) 2001:470:89c6:1::
Feb 1 07:19:38 cerowrt daemon.info hostapd: sw00: STA e0:75:7d:6c:67:de WPA: group key handshake completed (RSN)
Feb 1 07:20:09 cerowrt daemon.info dnsmasq-dhcp[2896]: RTR-ADVERT(sw10) 2001:470:89c6:2::
Feb 1 07:20:30 cerowrt daemon.info dnsmasq-dhcp[2896]: RTR-ADVERT(se00) 2001:470:89c6::
Feb 1 07:23:36 cerowrt daemon.info dnsmasq-dhcp[2896]: RTR-ADVERT(sw00) 2001:470:89c6:1::
Feb 1 07:24:57 cerowrt kern.info kernel: [5034424.527343] ge00: link down
Feb 1 07:29:38 cerowrt daemon.info hostapd: sw00: STA e0:75:7d:6c:67:de WPA: group key handshake completed (RSN)
Feb 1 07:29:41 cerowrt daemon.info dnsmasq-dhcp[2896]: RTR-ADVERT(se00) 2001:470:89c6::
Feb 1 07:29:50 cerowrt daemon.info dnsmasq-dhcp[2896]: RTR-ADVERT(sw10) 2001:470:89c6:2::
Feb 1 07:32:36 cerowrt daemon.info dnsmasq-dhcp[2896]: RTR-ADVERT(sw00) 2001:470:89c6:1::
Feb 1 07:38:52 cerowrt daemon.info dnsmasq-dhcp[2896]: RTR-ADVERT(se00) 2001:470:89c6::
Feb 1 07:39:12 cerowrt daemon.info hostapd: sw00: STA 74:e5:43:69:09:da IEEE 802.11: authenticated
Feb 1 07:39:12 cerowrt daemon.info hostapd: sw00: STA 74:e5:43:69:09:da IEEE 802.11: associated (aid 2)
Feb 1 07:39:12 cerowrt daemon.info hostapd: sw00: STA 74:e5:43:69:09:da RADIUS: starting accounting session 52806EEC-0000005B
Feb 1 07:39:12 cerowrt daemon.info hostapd: sw00: STA 74:e5:43:69:09:da WPA: pairwise key handshake completed (RSN)
Feb 1 07:39:12 cerowrt daemon.info dnsmasq-dhcp[2896]: DHCPDISCOVER(sw00) 172.30.42.74 74:e5:43:69:09:da
Feb 1 07:39:12 cerowrt daemon.info dnsmasq-dhcp[2896]: DHCPOFFER(sw00) 172.30.42.74 74:e5:43:69:09:da
Feb 1 07:39:12 cerowrt daemon.info dnsmasq-dhcp[2896]: DHCPREQUEST(sw00) 172.30.42.74 74:e5:43:69:09:da
Feb 1 07:39:12 cerowrt daemon.info dnsmasq-dhcp[2896]: DHCPACK(sw00) 172.30.42.74 74:e5:43:69:09:da a
Feb 1 07:39:12 cerowrt daemon.info dnsmasq-dhcp[2896]: RTR-ADVERT(sw00) 2001:470:89c6:1::
Feb 1 07:39:13 cerowrt daemon.info dnsmasq-dhcp[2896]: RTR-SOLICIT(sw00) 74:e5:43:69:09:da
Feb 1 07:39:13 cerowrt daemon.info dnsmasq-dhcp[2896]: RTR-ADVERT(sw00) 2001:470:89c6:1::
Feb 1 07:39:14 cerowrt daemon.info dnsmasq-dhcp[2896]: SLAAC-CONFIRM(sw00) 2001:470:89c6:1:76e5:43ff:fe69:9da a
Feb 1 07:39:15 cerowrt daemon.info dnsmasq-dhcp[2896]: DHCPINFORMATION-REQUEST(sw00) 00:04:fc:3a:bd:af:bb:b3:64:10:e1:fd:72:cf:0f:0c:c1:14 a
Feb 1 07:39:19 cerowrt authpriv.info dropbear[3709]: Child connection from 172.30.42.74:53620
Feb 1 07:39:20 cerowrt daemon.info dnsmasq-dhcp[2896]: RTR-ADVERT(sw00) 2001:470:89c6:1::
Feb 1 07:39:25 cerowrt authpriv.info dropbear[3709]: Exit before auth: Exited normally
Feb 1 07:39:28 cerowrt authpriv.info dropbear[3710]: Child connection from 172.30.42.74:53621
Feb 1 07:39:35 cerowrt authpriv.warn dropbear[3710]: Login attempt for nonexistent user from 172.30.42.74:53621
Feb 1 07:39:37 cerowrt daemon.info dnsmasq-dhcp[2896]: RTR-ADVERT(sw00) 2001:470:89c6:1::
Feb 1 07:39:38 cerowrt daemon.info hostapd: sw00: STA 74:e5:43:69:09:da WPA: group key handshake completed (RSN)
Feb 1 07:39:38 cerowrt daemon.info hostapd: sw00: STA e0:75:7d:6c:67:de WPA: group key handshake completed (RSN)
Feb 1 07:39:39 cerowrt authpriv.warn dropbear[3710]: Login attempt for nonexistent user from 172.30.42.74:53621
Feb 1 07:39:44 cerowrt authpriv.warn dropbear[3710]: Login attempt for nonexistent user from 172.30.42.74:53621
Feb 1 07:39:44 cerowrt authpriv.info dropbear[3710]: Exit before auth: Exited normally
Feb 1 07:39:45 cerowrt daemon.info dnsmasq-dhcp[2896]: RTR-ADVERT(sw10) 2001:470:89c6:2::
Feb 1 07:39:52 cerowrt kern.debug kernel: [5035318.730468] icmpv6_send: no reply to icmp error
Feb 1 07:39:55 cerowrt daemon.info dnsmasq-dhcp[2896]: RTR-ADVERT(sw00) 2001:470:89c6:1::
Feb 1 07:39:56 cerowrt kern.debug kernel: [5035322.816406] icmpv6_send: no reply to icmp error
Feb 1 07:40:00 cerowrt kern.debug kernel: [5035327.488281] icmpv6_send: no reply to icmp error
Feb 1 07:40:07 cerowrt authpriv.info dropbear[3712]: Child connection from 172.30.42.74:53629
Feb 1 07:40:10 cerowrt kern.debug kernel: [5035336.816406] icmpv6_send: no reply to icmp error
Feb 1 07:40:13 cerowrt daemon.info dnsmasq-dhcp[2896]: RTR-ADVERT(sw00) 2001:470:89c6:1::
Feb 1 07:40:13 cerowrt authpriv.notice dropbear[3712]: Password auth succeeded for 'root' from 172.30.42.74:53629
Feb 1 07:40:28 cerowrt kern.debug kernel: [5035355.472656] icmpv6_send: no reply to icmp error
Feb 1 07:40:43 cerowrt kern.info kernel: [5035370.363281] device ge00 entered promiscuous mode
Feb 1 07:40:44 cerowrt kern.info kernel: [5035371.164062] device ge00 left promiscuous mode
Feb 1 07:40:46 cerowrt kern.info kernel: [5035372.847656] device ge00 entered promiscuous mode
Feb 1 07:40:49 cerowrt kern.info kernel: [5035376.109375] device ge00 left promiscuous mode
Feb 1 07:46:37 cerowrt daemon.info dnsmasq-dhcp[2896]: RTR-ADVERT(se00) 2001:470:89c6::
More information about the Cerowrt-devel
mailing list