David DeSimone wrote: [ ... ]
Again, I did see these messages in my environment, but in my case, the error was correct: The IP *was not* on the local network. The reason being that we had multiple subnets configured on the same broadcast domain, so the BSD box could indeed hear ARP for subnets it did not know about. I don't know why the box feels moved to complain about this, however. I would think it should not care.
It's good practice for machines intended to be on different subnets to be in different collision domains. Seeing traffic to or from the wrong network should be considered a potential "red flag", warning that there might be a network misconfiguration that could compromise security.
In particular, if you want to securely host a bunch of client machines, setting them up on individual /30 subnets using a multiport firewall or a BSD box with a couple of 4-port NIC cards, rather than a switch, is a good idea. While this situation is something which is supposedly well-suited for VLANs, in practice most switches cannot be relied upon to actually prevent traffic from leaking outside of the specified VLAN.
This is more common for ARP traffic, which is sent to the all-ones MAC and may well get forwarded to all ports regardless of VLAN tagging, particularly if the switch is under load and has switched to some kind of "fast forwarding" mode or if it tends to consider all ports trunk ports by default or via dubious autolearning algorithms....
Regards, -- -Chuck _______________________________________________ freebsd-net@freebsd.org mailing list http://lists.freebsd.org/mailman/listinfo/freebsd-net To unsubscribe, send any mail to "[EMAIL PROTECTED]"
