Default route apparently overwritten whenever LAN machine is turned on

icarus24 · 09-30-2003, 03:14 PM

Hi there.

Using an adsl connection with rp-pppoe. So far so good (it seems).

Code:

Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
217.5.98.95     *               255.255.255.255 UH    0      0        0 ppp0
10.0.0.0        *               255.255.255.0   U     0      0        0 eth1
192.168.1.0     *               255.255.255.0   U     0      0        0 eth0
127.0.0.0       *               255.0.0.0       U     0      0        0 lo
default         217.5.98.95     0.0.0.0         UG    0      0        0 ppp0

At first I suspected the adsl setup to be faulty, because whenever I used the machine connected to the server (Mandrake 9.1) to check on it, the default route was changed, leaving the net, of course, unreachable.

Code:

Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
217.5.98.95     *               255.255.255.255 UH    0      0        0 ppp0
10.0.0.0        *               255.255.255.0   U     0      0        0 eth1
192.168.1.0     *               255.255.255.0   U     0      0        0 eth0
127.0.0.0       *               255.0.0.0       U     0      0        0 lo
default         *               0.0.0.0         U     0      0        0 eth0

Judging from the fact that irssi stays connected to the IRC server until right about the time I switch on the machine connected via LAN (actually a simple crossed-over RJ-45 cable) I assume the power-on of that machine prompts the route change on the server.

My question: what could do that? Is there any kind of log that would capture these route changes (more specifically, something that tells me what is responsible for it so I can find a way to make it die slowly and painfully).

If you require any further information, I'll be happy to provide it. Another interesting point may be that this didn't happen before a recent reinstall of Mandrake 9.1. The install is pretty fresh, meaning it's safe to assume standard settings for everything.

Thanks in advance.
Icarus

hakcenter · 09-30-2003, 03:55 PM

Unfortunatly I'm kinda confused

The mandrake machine is the router for your lan right?
It appears to have 2 lans cards?

By turning a machine on your lan, your mandrake route is changed?

What kind of software / os are you running on the machine that changes the route, or is it all the machines ?

icarus24 · 09-30-2003, 04:22 PM

> Unfortunatly I'm kinda confused
Sorry, I'll try and clear those things up.

> The mandrake machine is the router for your lan right?
> It appears to have 2 lans cards?
Correct and correct. eth0 is 192.168.1.1, serves the other machine as local gateway to the net. eth1 is connected to the DSL modem and thereby to the rest of the world.

> By turning a machine on your lan, your mandrake route
> is changed?
I'm not entirely positive about that but it's my best guess right now. Might also happen when I establish the (local) ssh connection to it. Remote (i. e. from routable, external IPs) ssh connections do not seem to trigger it. At least remote connections work for a while, even if not excessively tested. May also be that the route gets changed whenever the ssh connection runs through eth0?

> What kind of software / os are you running on the machine that
> changes the route, or is it all the machines ?
Not sure what you mean by "other machines". There are just two machines involved in this, directly connected by a cross-over LAN cable. One (the "server" with the two NICs) runs Mandrake 9.1, yet has no screen attached to it, the other one is a dual boot of Mandrake 9.1 and Windows XP that I use to monitor the "server" with.

Thanks again for any and all help.
Icarus

hakcenter · 09-30-2003, 04:53 PM

Heh, now im unconfused.

More than likely I could be a rogue service on the mandrake machine...

Try booting your machine up and just ping

66.218.71.198 --> yahoo.com but you should rely on any services of the router except forwarding.

Test it out throughly... it could be bad timing on your part, and a bad crontab or a bad daemon...

What daemons is the Mandrake running ?

icarus24 · 09-30-2003, 05:18 PM

Well, now that destroys my theory.

> More than likely I could be a rogue service on the
> mandrake machine...
Heh. What are you doing in my machine anyway. Just kidding. Had to exploit that typo somehow.

> Try booting your machine up and just ping
> 66.218.71.198 --> yahoo.com but you should rely on any
> services of the router except forwarding.
Errors that can't be reproduced are so hard to work with. Guess what. I just failed to reproduce it. After shutting down the XP desktop, waiting half a minute and booting it again, everything worked like it was supposed to.

So all I know now is that I have an adsl connection (which btw. gets cut every 24 hours by my ISP) that I never found down, yet I have a routing table that some evil spirit haunts every now and then. When it does happen though, it seems awfully close to the time I turn on the other machine.

> What daemons is the Mandrake running ?
Good question - since that finally led me to type a ps -a and spot a dhcpd that I certainly don't have any use for and might as well have been the source of all evil (from my limited understandings of these things point of view anyway). Killed it on sight.

Others that I found and was able to identify:
31159 ? 00:00:04 sshd
12755 ? 00:00:00 xinetd
17839 ? 00:00:00 dhcpd <--- now dead
12707 ? 00:00:00 crond
14235 ? 00:00:00 smbd
10286 ? 00:00:00 nmbd
26350 ? 00:00:00 httpd2 <--- couple more of those. I did intend to install apache though, even though the webmail I wanted running on it is a source of many more headaches.
20290 ? 00:00:00 adsl-connect <--- OK, not a daemon I guess, but I somehow deemed it relevant enough.
20888 ? 00:00:00 pppd

Cheers.
Icarus

hakcenter · 09-30-2003, 05:31 PM

More than definatly could of been your dhcpd

Make sure it stays out of your init, and you'll probably stop having close encounters of the ghostly kind.

icarus24 · 09-30-2003, 05:37 PM

The sucker's gone.

Going on a trip until Sunday, can't give an update until then, so thanks for the support in the meantime.

See you around.
Icarus

icarus24 · 10-01-2003, 12:58 AM

Good Morning,

as much as I hate to say it, when I turned on the desktop machine again this morning, the default route was replaced by

Code:

default         *               0.0.0.0         U     0      0        0 eth0

again.

It was *not* the dhcpd.

I have to get going for my vacation now - would really appreciate though if anyone could find another possible source of this trouble.

Thanks in advance and updates on Sunday, regards,
Icarus

icarus24 · 10-04-2003, 11:37 AM

There it is. Now it's official.

The Mandrake server was online rock-solid (as I'm told on IRC) for more than three days with a working default route.

The minute I get home from vacation, I switch on the dektop machine and the default route on the server is changed. No internet connection possible anymore and I have 120 seconds to reestablish a correct default route before irssi marks the disconnection from the IRC server.

Please give me a way, ANY way, to figure out what kind of wicked piece of software is responsible for changing the default route. Is there no kind of logging I can switch on that'll enable me to see and shoot the bugger on sight?

Thanks for any and all help,
Icarus

icarus24 · 10-05-2003, 05:05 AM

Hmmmm, no ideas? Do I have to go back to Win2k? Very sad. Things were alright before I reinstalled Mandrake, now it can't even keep its routes straight. And it's in all likelihood a very simple thing. One process to kill or one setting to change. Oh well.

Thanks for reading anyway.

Icarus