『求助』日志/var/log/messages

小苏子

在日志/var/log/messages里面有很多
Oct 16 09:02:46 gsgw /kernel: arp: 10.1.135.97 moved from 00:40:63:cb:2c:84 to 00:e0:4c:40:9c:27 on fxp0
Oct 16 09:02:46 gsgw /kernel: arp: 10.1.135.101 moved from 00:40:63:cb:2c:84 to 00:13:d3:e2:86:35 on fxp0
Oct 16 09:02:46 gsgw /kernel: arp: 10.1.135.104 moved from 00:40:63:cb:2c:84 to 00:13:46:64:cd:2a on fxp0
Oct 16 09:02:46 gsgw /kernel: arp: 10.1.135.111 moved from 00:40:63:cb:2c:84 to 00:11:d8:0f:b5:ce on fxp0
Oct 16 09:02:46 gsgw /kernel: arp: 10.1.135.112 moved from 00:40:63:cb:2c:84 to 00:05:5d:86:aa:8e on fxp0
Oct 16 09:02:46 gsgw /kernel: arp: 10.1.135.117 moved from 00:40:05:43:18:08 to 00:40:63:cb:2c:84 on fxp0
Oct 16 09:02:46 gsgw /kernel: arp: 10.1.135.118 moved from 00:16:ec:3d:66:ed to 00:40:63:cb:2c:84 on fxp0
Oct 16 09:02:46 gsgw /kernel: arp: 10.1.135.120 moved from 00:14:2a:10:6e:da to 00:40:63:cb:2c:84 on fxp0
Oct 16 09:02:46 gsgw /kernel: arp: 10.1.135.123 moved from 00:00:e8:4e:9f:be to 00:40:63:cb:2c:84 on fxp0
Oct 16 09:02:46 gsgw /kernel: arp: 10.1.135.124 moved from 00:10:5c:f6:f8:75 to 00:40:63:cb:2c:84 on fxp0
Oct 16 09:03:13 gsgw /kernel: arp: 10.1.135.120 moved from 00:40:63:cb:2c:84 to 00:14:2a:10:6e:da on fxp0
Oct 16 09:03:14 gsgw /kernel: arp: 10.1.135.120 moved from 00:14:2a:10:6e:da to 00:40:63:cb:2c:84 on fxp0
Oct 16 09:03:56 gsgw /kernel: arp: 10.1.135.117 moved from 00:40:63:cb:2c:84 to 00:40:05:43:18:08 on fxp0
Oct 16 09:03:56 gsgw /kernel: arp: 10.1.135.118 moved from 00:40:63:cb:2c:84 to 00:16:ec:3d:66:ed on fxp0
Oct 16 09:03:56 gsgw /kernel: arp: 10.1.135.120 moved from 00:40:63:cb:2c:84 to 00:14:2a:10:6e:da on fxp0
Oct 16 09:03:56 gsgw /kernel: arp: 10.1.135.123 moved from 00:40:63:cb:2c:84 to 00:00:e8:4e:9f:be on fxp0
Oct 16 09:03:56 gsgw /kernel: arp: 10.1.135.124 moved from 00:40:63:cb:2c:84 to 00:10:5c:f6:f8:75 on fxp0
Oct 16 09:03:56 gsgw /kernel: arp: 10.1.135.125 moved from 80:00:0c:2e:4a:70 to 00:40:63:cb:2c:84 on fxp0
Oct 16 09:03:56 gsgw /kernel: arp: 10.1.135.129 moved from 00:40:05:43:18:2d to 00:40:63:cb:2c:84 on fxp0
Oct 16 09:03:56 gsgw /kernel: arp: 10.1.135.130 moved from 00:00:b4:c0:9e:85 to 00:40:63:cb:2c:84 on fxp0
Oct 16 09:03:56 gsgw /kernel: arp: 10.1.135.131 moved from 00:11:d8:c5:f8:54 to 00:40:63:cb:2c:84 on fxp0
Oct 16 09:03:56 gsgw /kernel: arp: 10.1.135.133 moved from 00:05:5d:e8:5e:94 to 00:40:63:cb:2c:84 on fxp0
Oct 16 09:04:57 gsgw /kernel: arp: 10.1.135.125 moved from 00:40:63:cb:2c:84 to 80:00:0c:2e:4a:70 on fxp0
Oct 16 09:04:57 gsgw /kernel: arp: 10.1.135.129 moved from 00:40:63:cb:2c:84 to 00:40:05:43:18:2d on fxp0
Oct 16 09:04:57 gsgw /kernel: arp: 10.1.135.130 moved from 00:40:63:cb:2c:84 to 00:00:b4:c0:9e:85 on fxp0
Oct 16 09:04:57 gsgw /kernel: arp: 10.1.135.131 moved from 00:40:63:cb:2c:84 to 00:11:d8:c5:f8:54 on fxp0
Oct 16 09:04:57 gsgw /kernel: arp: 10.1.135.133 moved from 00:40:63:cb:2c:84 to 00:05:5d:e8:5e:94 on fxp0
Oct 16 09:04:57 gsgw /kernel: arp: 10.1.135.135 moved from 00:50:fc:0a:a0:d2 to 00:40:63:cb:2c:84 on fxp0
Oct 16 09:04:57 gsgw /kernel: arp: 10.1.135.138 moved from 00:80:92:0f:94:1c to 00:40:63:cb:2c:84 on fxp0
Oct 16 09:04:57 gsgw /kernel: arp: 10.1.135.140 moved from 00:16:ec:3d:79:c7 to 00:40:63:cb:2c:84 on fxp0
Oct 16 09:04:57 gsgw /kernel: arp: 10.1.135.144 moved from 00:e0:4c:40:92:cd to 00:40:63:cb:2c:84 on fxp0
Oct 16 09:04:57 gsgw /kernel: arp: 10.1.135.145 moved from 00:14:2a:b7:7e:7f to 00:40:63:cb:2c:84 on fxp0
Oct 16 09:05:13 gsgw /kernel: arp: 10.1.135.145 moved from 00:40:63:cb:2c:84 to 00:14:2a:b7:7e:7f on fxp0
Oct 16 09:05:13 gsgw /kernel: arp: 10.1.135.145 moved from 00:14:2a:b7:7e:7f to 00:40:63:cb:2c:84 on fxp0
Oct 16 09:05:58 gsgw /kernel: arp: 10.1.135.135 moved from 00:40:63:cb:2c:84 to 00:50:fc:0a:a0:d2 on fxp0

而其中mac地址00:40:63:cb:2c:84出现了很多次
谁能分析一下这是怎么一回事啊？？？

50g

很典型的arp欺骗，搜索论坛看看。