Re: urgent help needed for network problem!

   Possibility 1): Your network office is wrong, and the problem was
from something other than your computer. 
   Possibility 2): Your eth0 card has an intermittant failure.  If that's
the problem, the real fix is of course to replace it.  But maybe if you
set your firewall to DENY (with ipchains) or DROP (with iptables,
available in RH7.3) anything with destination 128.252.85.254 and source
different from 128.252.85.129 your computer wouldn't upset your network if
such a problem recurs.  If you log such packets, you can find out when
your card is accepting 128.252.85.254.
   Possibility 3): Somebody broke into your computer and temporarily made
your computer pretend to be the gateway. Although I don't expect putting
the card into promiscuous mode would upset your network, I could be wrong,
and crackers often install sniffers which do put interface cards into
promiscuous mode.  Maybe someone on this list or in your network office
can tell you if promiscuous mode could cause the symptoms they saw.  And
look up various tricks for detecting breakins.  If you do suspect a
breakin, change all passwords when you upgrade to 7.3, and make sure to do
all 7.3 updates.

On Mon, 4 Nov 2002 [email protected] wrote:

> 
> # grep -r 128.252.85.254 /etc/sysconfig/network-scripts/*
> 
> shows nothing, and # cat /etc/network shows nothing too.
> 
> My IP is 128.252.85.129 and gateway IP is 128.252.85.254.
> 
> Again, right now (afternoon) it does not show problem, so the school
> network office turned it up (so I can send the mails out).  But, they say 
> that the system showed problem yesterday to this morning.  
> 
> 
> On Mon, 4 Nov 2002 16:32:15 -0600 "Montz, James C. (James Tower)" wrote:
> 
> > My apologies.  Command line option for grep is -r  (not -R)
> > 
> > What is the output of 
> > # cat /etc/network?
> > 
> > What is the IP of the gateway?
> > 
> > -----Original Message-----
> > From: [email protected] [mailto:[email protected]] 
> > Sent: Monday, November 04, 2002 4:23 PM
> > To: [email protected]
> > Subject: Re: urgent help needed for network problem!
> > 
> > 
> > Ttwo ifcfg-* files are as below:
> > 
> > # cat ifcfg-eth0
> > DEVICE="eth0"
> > BOOTPROTO="none"
> > IPADDR="128.252.85.129"
> > NETMASK="255.255.255.0"
> > ONBOOT="yes"
> > IPXNETNUM_802_2=""
> > IPXPRIMARY_802_2="no"
> > IPXACTIVE_802_2="no"
> > IPXNETNUM_802_3=""
> > IPXPRIMARY_802_3="no"
> > IPXACTIVE_802_3="no"
> > IPXNETNUM_ETHERII=""
> > IPXPRIMARY_ETHERII="no"
> > IPXACTIVE_ETHERII="no"
> > IPXNETNUM_SNAP=""
> > IPXPRIMARY_SNAP="no"
> > IPXACTIVE_SNAP="no"
> > 
> > [root@morpheus network-scripts]# cat ifcfg-lo
> > DEVICE=lo
> > IPADDR=127.0.0.1
> > NETMASK=255.0.0.0
> > NETWORK=127.0.0.0
> > # If you're having problems with gated making 127.0.0.0/8 a martian,
> > # you can change this to something else (255.255.255.255, for example)
> > BROADCAST=127.255.255.255
> > ONBOOT=yes
> > NAME=loopback
> > BOOTPROTO=none
> > 
> > There is no GTEWAYIP line.  But, linuxconf does show the default gateway
> > is 128.252.85.254.  What's wrong?
> > 
> > Also, this system does not have -R option for grep.  
> > 
> > 
> > On Mon, 4 Nov 2002 15:55:41 -0600 "Montz, James C. (James Tower)" wrote:
> > 
> > > Not only that, but check for any other config scripts in
> > > /etc/sysconfig/network-scripts/ifcfg-*
> >
>  > 
> > > It may not be a bad idea to just do a quick check by using
> > > 
> > > Bash# grep -R <gateway IP> /etc/sysconfig/network-scripts/*
> > > 
> > > -----Original Message-----
> > > From: Taylor, ForrestX [mailto:[email protected]] 
> > > Sent: Monday, November 04, 2002 3:38 PM
> > > To: [email protected]
> > > Subject: Re: urgent help needed for network problem!
> > > 
> > > 
> > > [email protected] wrote:
> > > > Hi,
> > > > 
> > > > We have a RH6.2 server, which will be upgraded to 7.3 soon.  However,
> > > > currently it has a problem.  Our scholl's network office told me that
> > > > since yesterday, this machine takes over the IP address of our
> > gateway,
> > > > and so bring the whole subnet down.  So, they have to cut the line for
> > > > this server.  They ask me to check the system configuration.  But, I
> > > > could not find anything wrong: the system log, security, message and
> > > > linuxconf.  
> > > > 
> > > > Does anybody know what could cause this problem -- taking over the
> > > > gate
> way IP?  Where should I check? 
> > > 
> > > Use ifconfig to check that you have the correct IP address for the 
> > > machine and the gateway.  Then check 
> > > /etc/sysconfig/network-scripts/ifcfg-eth0 and look at the IPADDR= and 
> > > GATEWAY= lines.
> > > 
> > > Forrest
> > > -- 
> 

-- 
Steven Yellin