BBM
Verified User
On Feb 5, at 17:35:05, /var/log/messages started showing a lot of kernel-messages, along with ratelimit warnings;
At that time or before, nothing has been changed or altered on the server.
Can this be some form of mis-use on/of my VPS server?
After Googling around I've seen plenty of tips and advice on how to 'tune' the kernel-settings in sysctl.conf, but I don't think this is 'the' solution yet. It feels more like putting a bandaid to cover up a real issue.
IMO there has to be a reason why these messages are suddenly appearing. I've never seen them before on my VPS.
The server is hosting about 70-80 low traffic domains.
I noticed "sysctl.conf" doesn't have any lines dealing with ip6, so I had a look at this;
tcpdump -i eth0 -v ip6
Amongst what appears 'ligit' lines, I'm also seeing occassional bursts of these lines appear;
Along with a bunch of these messages:
Can anyone shed some light where to go to find out what happening here?
Code:
kernel: Neighbour Table Overflow.At that time or before, nothing has been changed or altered on the server.
Can this be some form of mis-use on/of my VPS server?
After Googling around I've seen plenty of tips and advice on how to 'tune' the kernel-settings in sysctl.conf, but I don't think this is 'the' solution yet. It feels more like putting a bandaid to cover up a real issue.
IMO there has to be a reason why these messages are suddenly appearing. I've never seen them before on my VPS.
The server is hosting about 70-80 low traffic domains.
I noticed "sysctl.conf" doesn't have any lines dealing with ip6, so I had a look at this;
tcpdump -i eth0 -v ip6
Amongst what appears 'ligit' lines, I'm also seeing occassional bursts of these lines appear;
Code:
12:34:25.677054 IP6 (hlim 1, next-header Options (0) payload length: 32) fe80::5054:ff:feb8:c811 > ff02::1:ff56:4c43: HBH (rtalert: 0x0000) (padn)[icmp6 sum ok] ICMP6, multicast listener report, length 24max resp delay: 0 addr: ff02::1:ff56:4c43
12:34:25.852446 IP6 (hlim 1, next-header Options (0) payload length: 32) fe80::5054:ff:fef2:5827 > ff02::1:fff2:5827: HBH (rtalert: 0x0000) (padn)[icmp6 sum ok] ICMP6, multicast listener report, length 24max resp delay: 0 addr: ff02::1:fff2:5827
12:34:26.075561 IP6 (hlim 1, next-header Options (0) payload length: 32) fe80::5054:ff:fe96:fbaa > ff02::1:ff18:c580: HBH (rtalert: 0x0000) (padn)[icmp6 sum ok] ICMP6, multicast listener report, length 24max resp delay: 0 addr: ff02::1:ff18:c580
12:34:26.151455 IP6 (hlim 1, next-header Options (0) payload length: 32) fe80::5054:ff:fe00:62d > ff02::1:ffab:95c1: HBH (rtalert: 0x0000) (padn)[icmp6 sum ok] ICMP6, multicast listener report, length 24max resp delay: 0 addr: ff02::1:ffab:95c1
12:34:26.154380 IP6 (hlim 1, next-header Options (0) payload length: 32) fe80::5054:ff:fed5:16ac > ff02::1:ffd5:16ac: HBH (rtalert: 0x0000) (padn)[icmp6 sum ok] ICMP6, multicast listener report, length 24max resp delay: 0 addr: ff02::1:ffd5:16ac
12:34:26.238131 IP6 (hlim 255, next-header ICMPv6 (58) payload length: 32) s02.bitnomica.com > ff02::1:ffa2:8720: [icmp6 sum ok] ICMP6, neighbor solicitation, length 32, who has fe80::216:3eff:fea2:8720
source link-address option (1), length 8 (1): 52:54:00:7b:4b:d3
12:34:26.332862 IP6 (hlim 1, next-header Options (0) payload length: 32) fe80::5054:ff:fe78:a273 > ff02::1:ff43:97ba: HBH (rtalert: 0x0000) (padn)[icmp6 sum ok] ICMP6, multicast listener report, length 24max resp delay: 0 addr: ff02::1:ff43:97ba
12:34:26.559721 IP6 (hlim 1, next-header Options (0) payload length: 32) fe80::5054:ff:fe05:dc31 > ff02::1:ff91:e882: HBH (rtalert: 0x0000) (padn)[icmp6 sum ok] ICMP6, multicast listener report, length 24max resp delay: 0 addr: ff02::1:ff91:e882
12:34:26.782210 IP6 (hlim 1, next-header Options (0) payload length: 32) fe80::5054:ff:fedb:efe1 > ff02::1:ff19:eede: HBH (rtalert: 0x0000) (padn)[icmp6 sum ok] ICMP6, multicast listener report, length 24max resp delay: 0 addr: ff02::1:ff19:eede
12:34:26.873693 IP6 (hlim 1, next-header Options (0) payload length: 32) fe80::5054:ff:feb4:b5b1 > ff02::1:ffd4:724e: HBH (rtalert: 0x0000) (padn)[icmp6 sum ok] ICMP6, multicast listener report, length 24max resp delay: 0 addr: ff02::1:ffd4:724e
12:34:27.096960 IP6 (hlim 1, next-header Options (0) payload length: 32) fe80::5054:ff:fe15:c181 > ff02::1:ff3f:d43d: HBH (rtalert: 0x0000) (padn)[icmp6 sum ok] ICMP6, multicast listener report, length 24max resp delay: 0 addr: ff02::1:ff3f:d43d
12:34:27.099640 IP6 (hlim 1, next-header Options (0) payload length: 32) fe80::5054:ff:feeb:d6e8 > ff02::1:ffec:86fd: HBH (rtalert: 0x0000) (padn)[icmp6 sum ok] ICMP6, multicast listener report, length 24max resp delay: 0 addr: ff02::1:ffec:86fd
12:34:27.315681 IP6 (hlim 1, next-header Options (0) payload length: 32) fe80::5054:ff:feb3:f00f > ff02::1:fff8:9563: HBH (rtalert: 0x0000) (padn)[icmp6 sum ok] ICMP6, multicast listener report, length 24max resp delay: 0 addr: ff02::1:fff8:9563
12:34:27.490885 IP6 (hlim 1, next-header Options (0) payload length: 32) fe80::5054:ff:fe23:4d91 > ff02::1:fff7:73f7: HBH (rtalert: 0x0000) (padn)[icmp6 sum ok] ICMP6, multicast listener report, length 24max resp delay: 0 addr: ff02::1:fff7:73f7
12:34:27.493431 IP6 (hlim 1, next-header Options (0) payload length: 32) fe80::5054:ff:fe37:6626 > ff02::1:ff7c:d6ec: HBH (rtalert: 0x0000) (padn)[icmp6 sum ok] ICMP6, multicast listener report, length 24max resp delay: 0 addr: ff02::1:ff7c:d6ec
12:34:27.598435 IP6 (hlim 1, next-header Options (0) payload length: 32) fe80::5054:ff:fe1a:e36d > ff02::1:ff1a:e36d: HBH (rtalert: 0x0000) (padn)[icmp6 sum ok] ICMP6, multicast listener report, length 24max resp delay: 0 addr: ff02::1:ff1a:e36d
...Along with a bunch of these messages:
Code:
12:36:24.961740 IP6 (hlim 255, next-header ICMPv6 (58) payload length: 32) 2a01:7c8:aaaf:4bb:5054:ff:fef2:14e1 > ff02::1:ff00:1: [icmp6 sum ok] ICMP6, neighbor solicitation, length 32, who has 149-210-183-225.colo.transip.net
source link-address option (1), length 8 (1): 52:54:00:f2:14:e1
12:36:25.411458 IP6 (hlim 255, next-header ICMPv6 (58) payload length: 32) fe80::aaaf:1 > ff02::1:ff00:1: [icmp6 sum ok] ICMP6, neighbor solicitation, length 32, who has 2a01:7c8:aaaf:b1::1
source link-address option (1), length 8 (1): 00:00:5e:00:02:c9
12:36:25.412776 IP6 (hlim 255, next-header ICMPv6 (58) payload length: 32) fe80::aaaf:1 > ff02::1:ff00:1: [icmp6 sum ok] ICMP6, neighbor solicitation, length 32, who has 2a01:7c8:aaaf:495::1
source link-address option (1), length 8 (1): 00:00:5e:00:02:c9
12:36:25.425146 IP6 (class 0xc0, hlim 255, next-header VRRP (112) payload length: 40) fe80::aaaf:2 > ff02::12: ip-proto-112 40
12:36:25.963589 IP6 (hlim 255, next-header ICMPv6 (58) payload length: 32) 2a01:7c8:aaaf:4bb:5054:ff:fef2:14e1 > ff02::1:ff00:1: [icmp6 sum ok] ICMP6, neighbor solicitation, length 32, who has 149-210-183-225.colo.transip.net
source link-address option (1), length 8 (1): 52:54:00:f2:14:e1
12:36:26.411244 IP6 (hlim 255, next-header ICMPv6 (58) payload length: 32) fe80::aaaf:1 > ff02::1:ff00:1: [icmp6 sum ok] ICMP6, neighbor solicitation, length 32, who has 2a01:7c8:aaaf:495::1
source link-address option (1), length 8 (1): 00:00:5e:00:02:c9
12:36:27.080381 IP6 (hlim 255, next-header ICMPv6 (58) payload length: 56) fe80::aaaf:1 > ff02::1: [icmp6 sum ok] ICMP6, router advertisement, length 56
hop limit 64, Flags [none], pref medium, router lifetime 12s, reachable time 0ms, retrans time 0ms
source link-address option (1), length 8 (1): 00:00:5e:00:02:c9
prefix info option (3), length 32 (4): 2a01:7c8:aaaf::/48, Flags [onlink, auto], valid time 2592000s, pref. time 604800s
12:36:27.410763 IP6 (hlim 255, next-header ICMPv6 (58) payload length: 32) fe80::aaaf:1 > ff02::1:ff00:1: [icmp6 sum ok] ICMP6, neighbor solicitation, length 32, who has 2a01:7c8:aaaf:495::1
source link-address option (1), length 8 (1): 00:00:5e:00:02:c9
12:36:27.411661 IP6 (hlim 255, next-header ICMPv6 (58) payload length: 32) fe80::aaaf:1 > ff02::1:ff00:1: [icmp6 sum ok] ICMP6, neighbor solicitation, length 32, who has 2a01:7c8:aaaf:b1::1
source link-address option (1), length 8 (1): 00:00:5e:00:02:c9
12:36:28.021984 IP6 (class 0xc0, hlim 255, next-header VRRP (112) payload length: 40) fe80::aaaf:2 > ff02::12: ip-proto-112 40
12:36:28.410736 IP6 (hlim 255, next-header ICMPv6 (58) payload length: 32) fe80::aaaf:1 > ff02::1:ff00:1: [icmp6 sum ok] ICMP6, neighbor solicitation, length 32, who has 2a01:7c8:aaaf:b1::1
source link-address option (1), length 8 (1): 00:00:5e:00:02:c9
...Can anyone shed some light where to go to find out what happening here?