Probelm "Neighbour Table overflow"

sometimes in console mode i get these error:

Feb 25 12:25:23 XXX kernel: NET: 270 messages suppressed.
Feb 25 12:25:23 XXX kernel: Neighbour table overflow.
Feb 25 12:25:27 XXX kernel: NET: 209 messages suppressed.
Feb 25 12:25:27 XXX kernel: Neighbour table overflow.
Feb 25 12:25:32 XXX kernel: NET: 313 messages suppressed.
Feb 25 12:25:32 XXX kernel: Neighbour table overflow.
Feb 25 12:25:37 XXX kernel: NET: 307 messages suppressed.


if i type: arp -a

? (192.168.194.28) at <incomplete> on eth0
? (192.168.149.180) at <incomplete> on eth0
? (192.168.173.58) at <incomplete> on eth0
? (192.168.54.94) at <incomplete> on eth0
? (192.168.163.16) at <incomplete> on eth0
? (192.168.208.99) at <incomplete> on eth0
? (192.168.55.123) at <incomplete> on eth0
? (192.168.130.234) at <incomplete> on eth0
? (192.168.31.62) at <incomplete> on eth0
? (192.168.75.35) at <incomplete> on eth0
? (192.168.9.186) at <incomplete> on eth0
? (192.168.94.237) at <incomplete> on eth0
? (192.168.242.247) at <incomplete> on eth0
? (192.168.250.0) at <incomplete> on eth0
? (192.168.232.128) at <incomplete> on eth0
? (192.168.71.244) at <incomplete> on eth0
? (192.168.193.224) at <incomplete> on eth0

(i get more lines ......)

my network are: 192.168.0.x not know these ips(arp table)....

i use eth0 for my lan and ppp0 for get internet.....

my linux internet server is not working properly, and not share internet.... no WWW no MAIL....

thanks any advice?

You may have someone on your network scanning for other pcs, eg a kazaa client
Also check if your net card is in promiscuous mode or not.
do ifconfig to read the setup information.
Do you have a net monitor running, eg arpwatch, nessus?

i checked some pcs and 3 have emule connection....


my ifconfig:

[root@ServerWB root]# ifconfig
eth0 Link encap:Ethernet HWaddr 00:08:54:23:81:F9
inet addr:192.168.102.5 Bcast:192.168.255.255 Mask:255.255.0.0
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:829302 errors:0 dropped:0 overruns:0 frame:0
TX packets:6600354 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:1000
RX bytes:526447909 (502.0 Mb) TX bytes:646197510 (616.2 Mb)
Interrupt:10 Base address:0x5f00

eth1 Link encap:Ethernet HWaddr 00:08:54:23:81A
inet addr:192.168.0.1 Bcast:192.168.0.255 Mask:255.255.255.0
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:8731046 errors:0 dropped:0 overruns:0 frame:0
TX packets:976644 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:1000
RX bytes:752723371 (717.8 Mb) TX bytes:447384199 (426.6 Mb)
Interrupt:10 Base address:0x7e00

eth1:1 Link encap:Ethernet HWaddr 00:08:54:23:81A
inet addr:192.168.102.6 Bcast:192.168.102.255 Mask:255.255.255.0
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:0 errors:0 dropped:0 overruns:0 frame:0
TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:1000
RX bytes:0 (0.0 b) TX bytes:0 (0.0 b)
Interrupt:10 Base address:0x7e00

lo Link encap:Local Loopback
inet addr:127.0.0.1 Mask:255.0.0.0
UP LOOPBACK RUNNING MTU:16436 Metric:1
RX packets:187664 errors:0 dropped:0 overruns:0 frame:0
TX packets:187664 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:0
RX bytes:37315899 (35.5 Mb) TX bytes:37315899 (35.5 Mb)

ppp0 Link encap:Point-to-Point Protocol
inet addr:200.67.xxx.xxx P-t-P:148.235.xxx.xxx Mask:255.255.255.255
UP POINTOPOINT RUNNING NOARP MULTICAST MTU:1492 Metric:1
RX packets:675123 errors:0 dropped:0 overruns:0 frame:0
TX packets:2356000 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:3
RX bytes:439757647 (419.3 Mb) TX bytes:279195037 (266.2 Mb)

[root@ServerWB root]#



in 1 pc i running ethereal, but after the errors... for check the traffic....


Thanks

So it looks like just the emule scanning traffic when it first starts up, randomly trying every possible ip number..
Lots of network traffic..
Once they have learnt the local network, they tend to be quiet..

I'll have a look and see if there are any /proc settings that will allow you to ignore them safely..

ok i wait:
I'll have a look and see if there are any /proc settings that will allow you to ignore them safely..



how block emule, kazza ????
iptables?


thanks

Just wanted to note that I've had the same problems recently. Only one PC on the LAN but it sometimes is running emule, which could account for the large network traffic.

Then again, it has also happened with emule turned off