Is it normal to have link state changed to UP many times

[Lothian]

Hi, every day I get the following on my daily security run report. I don't know what the significance of this is, or if it indicates any problem on my system. It is too bad that the report does not give any indication of time. I have two VMs and one jail defined. I notice that the Ethernet address is changing constantly. Perhaps this is related to the VPN (PIA using their software) that I am running in one of the VMs? Can any body tell me if this is a serious issue that should be addressed, or if it is just the normal operation of the NAS. Thanks


Nas.XXXX.YYY kernel log messages:

tap0: link state changed to DOWN
tap0: Ethernet address: 00:bd:87:e5:08:00
tap0: promiscuous mode enabled
tap0: link state changed to UP
tap0: link state changed to DOWN
tap0: Ethernet address: 00:bd:e8:92:42:00
tap0: promiscuous mode enabled
tap0: link state changed to UP
tap0: link state changed to DOWN
tap0: Ethernet address: 00:bd:73:db:78:00
tap0: promiscuous mode enabled
tap0: link state changed to UP
tap0: link state changed to DOWN
tap0: Ethernet address: 00:bd:ae:ba:a2:00
tap0: promiscuous mode enabled
tap0: link state changed to UP
tap0: Ethernet address: 00:bd:85:9d:b1:00
tap0: promiscuous mode enabled
tap0: link state changed to UP
tap0: Ethernet address: 00:bd:24:d4:be:00
tap0: promiscuous mode enabled
tap0: link state changed to UP
​

-- End of security output --

 

[dlavigne]

Unfortunately, the report comes from FreeBSD's periodic scripts which is not timestamped. However, you should be able to find a timestamped version in /var/log/messages . Do the entries in that log provide a better idea of what is happening around that time?

 

[newfreenas]

I have been experiencing something similar as well: I viewed the logs manually with

Code:

sudo cat /var/log/messages | grep kernel

the output seems to show that my tap0 interface is constantly through the day having ~3500 actions a day like below. I have ignored in past but now that I fixed my smtp connection I am getting the daily email and am investigating.

Code:

Mar  9 23:04:57 freenas kernel: tap0: link state changed to UP
Mar  9 23:04:57 freenas kernel: tap0: link state changed to UP
Mar  9 23:05:07 freenas kernel: tap0: link state changed to DOWN
Mar  9 23:05:07 freenas kernel: tap0: link state changed to DOWN
Mar  9 23:05:08 freenas kernel: tap0: promiscuous mode enabled
Mar  9 23:05:08 freenas kernel: tap0: link state changed to UP
Mar  9 23:05:08 freenas kernel: tap0: link state changed to UP
Mar  9 23:05:18 freenas kernel: tap0: link state changed to DOWN
Mar  9 23:05:18 freenas kernel: tap0: link state changed to DOWN
Mar  9 23:05:18 freenas kernel: tap0: promiscuous mode enabled
Mar  9 23:05:19 freenas kernel: tap0: link state changed to UP
Mar  9 23:05:19 freenas kernel: tap0: link state changed to UP
Mar  9 23:05:28 freenas kernel: tap0: link state changed to DOWN
Mar  9 23:05:28 freenas kernel: tap0: link state changed to DOWN
Mar  9 23:05:29 freenas kernel: tap0: promiscuous mode enabled
Mar  9 23:05:30 freenas kernel: tap0: link state changed to UP
Mar  9 23:05:30 freenas kernel: tap0: link state changed to UP

after doing a number of searches it seems a handful of others have experienced similar and in one case it was found to be a NIC compatability issue... I ahve not been able to verify anything here but if anyone has any info to look at here please let me know. I am running a couple bhyve VM's but this behavior is unexpected and unusual.

 

[Patrick M. Hausen]

A tap interface is a virtual interface used with a VM. Are you rebooting a particular VM regularly?

 

[newfreenas]

Generally I leave the VMs up permanently. - This behavior happens without intervention and the VM's I'm using are working great.

the pattern I'm noticting is about once every ~10 seconds from start of previous 'chunk' there is a new 'chunk'

Code:

Mar 10 08:54:58 freenas kernel: tap0: link state changed to DOWN
Mar 10 08:54:58 freenas kernel: tap0: link state changed to DOWN
Mar 10 08:55:00 freenas kernel: tap0: promiscuous mode enabled
Mar 10 08:55:01 freenas kernel: tap0: link state changed to UP
Mar 10 08:55:01 freenas kernel: tap0: link state changed to UP

so after this I see another 'chunk' at 08:55:09 10 of the same , down down, promiscuous mode ,up up.


it is very strange.

 

[Patrick M. Hausen]

What's inside that VM? Some Linux cloud-update-my-dynamic-ip-address thingy going haywire? The "promiscuous mode enabled" part makes me wonder if there's anything inside your VM toggling the interface.

I just noticed: the MAC address changes every time - so the interface is destroyed and recreated ... weird. Maybe this points you in the right direction. The "attached to" line in ifconfig tells you which VM is running on that interface:

Code:

ifconfig
[...]
tap0: flags=8943<UP,BROADCAST,RUNNING,PROMISC,SIMPLEX,MULTICAST> metric 0 mtu 1500
    description: Attached to onlyoffice
[...]

 

[newfreenas]

thank you, no dynamic thing that I am aware of, it is running an openbsd VM, this vm is primarily running nginx with a few servers proxied behind it

that being said, I think it was an issue prior to installing nginx. the MAC adjusting a little each time is consistent and I'm really confused as to why this would occur, I can say the services I'm hosting in my lab do not seem to have an issue. just nerdy home lab stuff....

I should also note it is openbsd 6.6 which has some issue with assigning multiple CPU's to it and I had to use only a single PCU to get it up, I believe the MP config is not available or selected by default when upgrading from 6.5... this is entirely a separate issue but could point to other default changes.

I have another openbsd 6.4 vm running without this issue (as the itnerface is only tied to the other)