Can't decipher security run outputs

[cen]

I am getting security run updates on my email every few days and I have no idea whether this are just false alarms or something is actually wring on my machine. Can someone explain me what these errors mean?

arp: 192.168.2.38 moved from dc:c7:93:f1:ec:f8 to 62:66:b3:56:66:a7 on igb0
arp: 192.168.2.38 moved from dc:c7:93:f1:ec:f8 to 62:66:b3:56:66:a7 on igb0
arp: 192.168.2.38 moved from 62:66:b3:56:66:a7 to dc:c7:93:f1:ec:f8 on igb0
ipmi0: KCS: Reply address mismatch
ipmi0: KCS error: 5f
ipmi0: KCS: Reply address mismatch
ipmi0: KCS error: 5f
ipmi0: KCS: Reply address mismatch
ipmi0: KCS error: 5f
ipmi0: Failed to set watchdog
ipmi0: KCS: Reply address mismatch
ipmi0: KCS error: 5f
ipmi0: KCS: Reply address mismatch
ipmi0: KCS error: 5f
ipmi0: KCS: Reply address mismatch
ipmi0: KCS error: 5f
ipmi0: KCS: Reply address mismatch
ipmi0: KCS error: 5f
ipmi0: Failed to set watchdog
ipmi0: KCS: Reply address mismatch
ipmi0: KCS error: 5f
arp: 192.168.2.38 moved from dc:c7:93:f1:ec:f8 to 62:66:b3:56:66:a7 on igb0
arp: 192.168.2.38 moved from 62:66:b3:56:66:a7 to dc:c7:93:f1:ec:f8 on igb0
arp: 192.168.2.38 moved from dc:c7:93:f1:ec:f8 to 62:66:b3:56:66:a7 on igb0
arp: 192.168.2.38 moved from 62:66:b3:56:66:a7 to dc:c7:93:f1:ec:f8 on igb0
arp: 192.168.2.38 moved from dc:c7:93:f1:ec:f8 to 62:66:b3:56:66:a7 on igb0

 

[dlavigne]

Is there a DHCP server on the network giving out that IP to another host?

 

[cen]

I believe I configured DHCP to always give the same IP to freenas box. I don't have access to my router at the moment so I will update the topic tomorrow with my DHCP settings.

 

[SweetAndLow]

Looks like IP conflict in your network.

 

[cen]

Ok so I guess there must be a conflict and I messed something up. The motherboard has 3 LAN ports, one of these is for IPMI. I have the NAS plugged in into a router on a normal port, no other cables.
I have mapped static DHCP on the router like this:

BC:5F:F4:FE:31:AD 192.168.2.151 (ipmi)
D0:50:99:1B:64:BF 192.168.2.150 (igb0)

I can access the FreeNAS web interface on 192.168.2.150 and IPMI on 192.168.2.151 even tho I do not have any cable plugged in the management interface. And it works for whatever reason but could this be the problem? No idea where 192.168.2.38 comes from tho.

 

[DrKK]

Ok so I guess there must be a conflict and I messed something up. The motherboard has 3 LAN ports, one of these is for IPMI. I have the NAS plugged in into a router on a normal port, no other cables.
I have mapped static DHCP on the router like this:

BC:5F:F4:FE:31:AD 192.168.2.151 (ipmi)
D0:50:99:1B:64:BF 192.168.2.150 (igb0)

I can access the FreeNAS web interface on 192.168.2.150 and IPMI on 192.168.2.151 even tho I do not have any cable plugged in the management interface. And it works for whatever reason but could this be the problem? No idea where 192.168.2.38 comes from tho.

That last part, the ARP messages about 192.168.2.38 moving from this MAC to that MAC and back again, is almost ALWAYS the same thing: You have multiple access points in your house (e.g., a main router and a repeater), and some device (could be anything---a phone, whatever) is going from one access point NIC to the other. You can find out what 192.168.2.38 is by using a network analysis tool; the one I like to use in a case like this is "fing" for Android. It'll tell you what every IP on your network is being used by. Of course, it gives you the manufacturer OF THE NETWORK INTERFACE on devices, so you might have to cross reference the manufacturer to a device.

 

[cen]

Ok, I checked my DHCP leases and 192.168.2.38 is my sister's windows phone. But why the hell would FreeNAS care if some phone changed mac and bother me with this useless information in a security output? Or is the actual problem the ipmi0 lines and the arp switching just happens to be around in the syslog?

 

[DrKK]

Right, so, I wouldn't worry about those ARP changing messages, those are just FYI. Perfectly normal. In certain cases, you see, it can indicate that a hijacker has done something with a router in the network, which is why it is there, but 99.1% of the time, it's just a mobile device changing routers on your network.

The other message, if I had to guess, which I also seem to confirm by a medium-deep google, may have to do with IPMI. You don't include your hardware in your post (naughty), so I can't verify that you have an IPMI board, but a lot of the people reporting this issue have traced it back to a jacked-up IPMI interface.

 

[cen]

I have this one if it helps with anything: http://www.asrockrack.com/general/productdetail.asp?Model=C2550D4I#Specifications

 

[DrKK]

Definitely has an AST2300 IPMI on board. You may wish to connect to that and make sure it's up to date.

You do know how IPMI works, or am I speaking Greek to you?

 

[cen]

Ok, I'll try that. I'll report back in a few days if anything interesting happens.