CARP (VRRPv2 advertisements) spamming filter logs

[mbartosch]

Hi,

currently running 2.0-BETA4 (i386) built on Mon Dec 20 22:18:43 EST 2010.

I noticed that after the update from an earlier 2.0 beta snapshot my filter logs get spammed by CARP messages.

In /tmp/rules.debug I found the responsible rule (which is inserted literally by etc/inc/filter.inc):

block in log quick proto carp from (self) to any

If I remove the "log" statement from the above rule and reload the filter, my filter log looks fine. I am wondering why the VRRPv2 advertisements from self should be logged at all…?

cheers

Martin

---

From the filter logs:

Dec 22 10:43:19 exgate0 pf:    172.16.27.248 > 224.0.0.18: VRRPv2, Advertisement, vrid 10, prio 0, authtype none, intvl 1s, length 36, addrs(7): 224.149.14.34,144.238.89.40,165.242.63.226,58.252.56.254,219.114.156.115,130.180.223.68,62.150.208.112
Dec 22 10:43:19 exgate0 pf: 00:00:00.070089 rule 11/0(match): block in on lagg0_vlan2911: (tos 0x10, ttl 255, id 39763, offset 0, flags [DF], proto VRRP (112), length 56)
Dec 22 10:43:19 exgate0 pf:    172.16.25.248 > 224.0.0.18: VRRPv2, Advertisement, vrid 8, prio 0, authtype none, intvl 1s, length 36, addrs(7): 7.61.130.9,206.172.121.117,98.225.252.147,166.89.46.149,168.141.226.202,231.133.174.63,54.248.239.147
Dec 22 10:43:19 exgate0 pf: 00:00:00.069976 rule 11/0(match): block in on lagg0_vlan2902: (tos 0x10, ttl 255, id 2097, offset 0, flags [DF], proto VRRP (112), length 56)h 36, addrs(7) VRRP

[jimp]

You should never see the advertisements from (self) come in off the wire.

If you do, you likely have a layer2 loop.

[mbartosch]

Thanks, this would explain it (and some other problems). The issue went away after rebooting the switches. Guess they forgot they had eben configured with LACP somehow.

Apologies for the false alarm.

Cheers,

M.