Unfuckingbelievable.

[theweaselking]

I hate computers.

Running an IDS. Ubuntu 10.04 LTS Server machine, two NICs, set up with one "normal" NIC and one promiscuous NIC for packet sniffing, attached to a port-mirrored switch so it sees all the traffic(tm).

Problem: As soon as eth1 is "up", the machine drops my console session. It disconnects me. I can reconnect, and I've got between 2 and 15 seconds to get logged in and get out a "sudo ifconfig eth1 down" and the password before I get dropped again. If I beat the clock and drop eth1, I'm fine until I restart it.

What the hell could be causing this? I WAS getting log messages about a duplicate IPv6 address on the network, so I disabled IPv6 completely.

Difficulty: The machine's in another country, and the only on-site person can be most generously described as "non-technical", and perhaps more accurately described as doesn't read or follow instructions or answer questions.

EDIT oh holy crap what are both NICs showing the obviously-fake MAC address "HWaddr aa:00:04:00:0a:04"? Won't that pretty much cause this EXACT thing? And how the fuck can I fix that shit?

EDIT2: "List of interfaces to set MAC address to DECNet node address: All" Fucking DECNet, what the living FUCK is that doing in a fresh Ubuntu 10 install?4

EDITLAST: Fucking DECNet. Remove that reboot, suddenly I have real MACs, and problem solved.

Comments

[scifantasy.livejournal.com]

Google says it might have to do with DECnet:

http://www.fantaghost.com/2010/06/eth0-mac-address-fixed-on-aa0004000a04/

[theweaselking.livejournal.com]

I was just finding that.

[scifantasy.livejournal.com]

My Google-fu is mighty, and my current assignment at work is mind-numbingly dull (leading to a frequent need for temporary distraction).

[theweaselking.livejournal.com]

Yeah. I was just looking at the output of ifconfig, and the MACs jumped out at me, and after that it was just swearing.

[jerril]

Difficulty: The machine's in another country, and the only on-site person can be most generously described as "non-technical", and perhaps more accurately described as doesn't read or follow instructions or answer questions.

I keep asking myself if the problem is lack of reading comprehension, or lack of giving-a-fuck.

[theweaselking.livejournal.com]

Both.

[aeduna.livejournal.com]

I have been finding my debian machine installing debian because it has ffmpeg.

I'll give that a minute to sink in.

*Apparently* libdnet is required by ffmpeg for... something.... and at least on debian it is going "ok, you have libdnet, and that prob means you want dnet-common... hold on while I fuck your MAC address and everything else *right up*"

[aeduna.livejournal.com]

Argh. "installing decnet" I mean. Its early.

[theweaselking.livejournal.com]

That's okay, I got it.

And YES. That is EXACTLY what happened. Dnet as a requirement for something else, decnet assumes that you WANT a computer that cannot speak TCP/IP in an intelligent environment and doesn't bother to check with you, even if you WANTED decnet and were planning to configure it to non-asstard you're fucked NOW because it's fucked all your interfaces.

[aeduna.livejournal.com]

I was lucky and debian popped the "hey, would you like to set Dnet up to fuck you over right now, or later?"... and managed to remove the package before it crippled me. I'll add it to the list of things to look for in every daily update, shall I?

[lafinjack.livejournal.com]

My fetish is promiscuous NICs.