Server(proxmox?) claims foreign IP-Adress

[rh3]

Hi there,

i have a serious problem with my root server, according to my ISP (Serverhoster) my Server (MAC) responds ARP-Requests, claiming to possess foreign ip-adresses (in the same subnet).

Actually i have no idea why it does so, all ip configurations are static.

i also have some openct vms running with vmbr0 as well as veth0(just "set" an ip adress)
afaik, the veth0 is bridging the eth0 interface so its possible for VMs to claim foreign ip adresses, but my ip configurations are static and i never set foreign adresses since i'm using a private subnet like 192.168.x.y, combined with NAT/MASQUERADE via iptables.
can NAT/MASQUERADE result in overtaking ip-addresses?

my hoster cut understandably the network connection so i can only perform "dry" debugging via vnc/kvm, is there a way to virtually turn eth0 so i can analyze the network traffic?

greetings and thank you for helping

 

[Mr.Holmes]

Hello rh3,

i also have some openct vms running with vmbr0 as well as veth0(just "set" an ip adress)

"Just set" an IP address in a container is venet0 and not veth - in that case is not bridged either, it is - seen from outside - like an additional address assigned in the host.

afaik, the veth0 is bridging the eth0 interface so its possible for VMs to claim foreign ip adresses, but my ip configurations are static and i never
set foreign adresses since i'm using a private subnet like 192.168.x.y, combined with NAT/MASQUERADE via iptables.
can NAT/MASQUERADE result in overtaking ip-addresses?

No - but it´s question if you have bridges and veth - see above.

It can be clarified if you post your configuration file

/etc/pve/openvz/<ct-id>.conf

my hoster cut understandably the network connection so i can only perform "dry" debugging via vnc/kvm, is there a way to virtually turn eth0 so i can analyze the network traffic?

Wouldn´t it be possible getting from your ISP the details about what is going wrong? Then you can make virtual NICs in order to reproduce and study the error case.

Kind regards

Mr.Holmes

 

[rh3]

actually they just sent a copy of an ARP-reply given by a NIC wich has my MAC:

13:32:34.582503 b0:c6:9a:69:04:8a > ff:ff:ff:ff:ff:ff, ethertype ARP (0x0806), length 60: Request who-has 144.76.72.235 tell 144.76.72.225, length 46 13:32:34.994346 08:60:6e:69:59:78 > b0:c6:9a:69:04:8a, ethertype ARP (0x0806), length 60: Reply 144.76.72.235 is-at 08:60:6e:69:59:78, length 46

so now where deos this reply come from? most likely from my machine, but on my machine, beside proxmox, there is not running much.

Hello rh3,
"Just set" an IP address in a container is venet0 and not veth - in that case is not bridged either, it is - seen from outside - like an additional address assigned in the host.

No - but it´s question if you have bridges and veth - see above.
It can be clarified if you post your configuration file
/etc/pve/openvz/<ct-id>.conf

acutally the machine is offline atm. so i cannot just post all configs but screenshooting them
but i did a
cat /etc/pve/openvz/*conf|grep 235
cat /etc/pve/openvz/*conf|grep 144\.76\.72\.235
and there was no output.

Wouldn´t it be possible getting from your ISP the details about what is going wrong? Then you can make virtual NICs in order to reproduce and study the error case.

Kind regards

Mr.Holmes

Thanks for your help, i appreciate it!
can "bridging" make my NIC go online even if the plug is pulled?

What else kind of information could i ask my hoster for?

i can request a KVM console for 3 hours but not up/dowload anything :-/

 

[Mr.Holmes]

Hello rh3

actually they just sent a copy of an ARP-reply given by a NIC wich has my MAC:

08:60:6e:69:59:78 144.76.72.235

Your next step should be now to verify the configuration related to the NIC which has that MAC carefully:

- is it used in a bridge?

- is it used for a virtual NIC (too)?

- check also the configuration inside your VMs and CTs!

- occurs somewhere the address 144.76.72.235? Where ever it is, in the host, a CM or a CT (not only in the mentioned ".conf" files!)

If all the above is not the case your provoder is probably wrong - in this case: maybe somebody else has "stolen" your MAC address (such things can happen - and the same MAC address twice in a subnet causes total confusion)!?

can "bridging" make my NIC go online even if the plug is pulled?

No - it remains in that case within your (virtual) environment

What else kind of information could i ask my hoster for?

To get a least a virtual console ithout time limitation in order to investigate your environment. Verify then with tcpdump what really happens at your NIC.

Kind regards

Mr.Holmes