dhcp/modem issue

[Tim Ponder]

Hello,
I recently had some strange behavior on our HP 735 running HP-UX 10.20

When looking at the syslog to try to identify what was happening, I found this type of entry once a day for the past several days.

===
Feb 3 16:39:09 153.69.254.254 0000 410 DHCP CLIENT Discovering | Discover B
y: 00601D205C76
Feb 3 16:39:09 153.69.254.254 0001 220 Modem Command Response | ATI1^M
Feb 3 16:39:09 153.69.254.254 0002 220 Modem Command Response | AMBIT KITT
Y VERSION 0004, 5/10/2000^M
Feb 3 16:39:10 153.69.254.254 0003 220 Modem Command Response | OK^M
Feb 3 16:39:13 153.69.254.254 0004 100 System Startup |
Feb 3 16:39:18 archon popper[4868]: Stats: kmccoy 0 0 140 3664432
Feb 3 16:39:19 153.69.254.254 0005 410 DHCP CLIENT Discovering | Discover B
y: 00601D205C76
Feb 3 16:39:29 153.69.254.254 0006 410 DHCP CLIENT Discovering | Discover B
y: 00601D205C76
==
The DHCP message repeats about every 10 seconds for almost 3 hours.

Some basic information:
The server is not (that I can find) set up as a DHCP server.
It should not be looking for a DHCP server.
The IP address nor the interface is not anywhere on our campus network.
I cannot resolve a DNS lookup on the IP address.
We do not have a modem or terminal server connected to this machine anymore.
I do not see anything using who, last or ps about this connection when this is occurring, or afterwards.
Mail delivery, especially of mailing list mail really bogs down while this occurs, as do some other network operations.

We use this machine for web services and email, and my knowledge does not extend much past the basics and what I need for those operations. Any ideas on what is going on, where to look for more information and how to stop this (assuming its not normal) would be appreciated. I have done a little searching, but not found anything solid to go on.

Thank You
tim
--
Tim Ponder
tponder@literacy.kent.edu

[Steven E. Protter]

When you dial out with a modem to the Internet for example, the customary setup is to let the ISP set the IP address.

If you are assigned an IP address and gateway to set manually, you can do that as well.

When you dial out to the net there is a network intferface starting with ppp for point to point protocol. It acts like a NIC card and handles network traffic through the dial out link.

This has nothing to do with whether the machine that owns the modem is a DHCP server or not.

It looks like from the message your machine is trying to dial out with the modem, activate the ppp interface and get assigned an IP address by the remote server. It looks like that process if failing.

If you don't intend to dial out for any reasons, you might want to look at sam and deactivate the current modem setup.

P

[Pete Randall]

Let's bounce this back up to the top - somebody's got to have a theory.

Pete

[Darren Prior]

Hi,

I'd suggest that you check all crontabs & at -l to see if there's anything being started on a daily basis. I'm not sure this is very likely, but it's another avenue to check.

Is the quoted IP 153.69.254.254 this workstation, or another machine? If it's another then another machine is sending some data from syslogd to this workstation. Check the /etc/syslog.conf file on the appropriate machine.

regards,

Darren.

[Pete Randall]

Tim is on the road today and unable to respond but will be getting back to this - so let's bounce it back to the top one more time!

Come on people, I convinced Tim to try this forum by bragging about how good you all are - let's show him!

Pete

[Tim Ponder]

I checked cron and at and nothing is scheduled to run. I looked at syslog.conf and there is nothing in it but the syslog and mail.log settings.

153.69.254.254 is not this machine, nor is it one I can track down. It is not within our network at all, the campus is all under 131.123.XXX.XXX so I am not sure where the requests are coming from, or if they are going out, why they are going out.

There is no modem set up on this machine, nor is there any old modem configuration still laying around either.

Thoughts???