problem on my end or someone leaking dhcp?

[Calderon]

Im on university network IP´s from range 91.X.X.X. I started having below message couple hours ago. dc0 is external and xl0 is my LAN (192.168.0.0/24)

Feb 23 12:55:21 bsdkone kernel: arp: 192.168.0.1 is on lo0 but got reply from 00:21:91:72:14:64 on dc0
Feb 23 12:55:36 bsdkone last message repeated 5 times
Feb 23 12:58:09 bsdkone last message repeated 16 times
Feb 23 12:59:26 bsdkone last message repeated 12 times
Feb 23 13:00:31 bsdkone kernel: dc0: promiscuous mode enabled
Feb 23 13:00:52 bsdkone kernel: arp: 192.168.0.1 is on lo0 but got reply from 00:21:91:72:14:64 on dc0
Feb 23 13:01:07 bsdkone last message repeated 5 times
Feb 23 13:01:46 bsdkone kernel: dc0: promiscuous mode disabled
Feb 23 13:01:55 bsdkone kernel: arp: 192.168.0.1 is on lo0 but got reply from 00:21:91:72:14:64 on dc0
Feb 23 13:02:04 bsdkone kernel: arp: 192.168.0.1 is on lo0 but got reply from 00:21:91:72:14:64 on dc0

So is this doing harm on me, is this somehow my fault (doubt it, because this started just hours ago, and i have been running this for months without problems) or someone leaking something to this network. How can i prevent this. Changin my LAN subnet maybe? or can i block this with PF?

[anomie]

192.168.0/24 is private IP space. It seems most likely to me that this is a misconfiguration.

Did you assign 192.168.0.1 to your lo0? Please post the output of % ifconfig

Note that .1 on a /24 subnet is often the default router.

[Calderon]

bfe0: flags=8843<UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST> metric 0 mtu 1500
        options=8<VLAN_MTU>
        ether 00:e0:18:bf:57:68
        inet 84.249.135.xxx netmask 0xfffff000 broadcast 84.249.143.255
        media: Ethernet autoselect (100baseTX <full-duplex>)
        status: active
dc0: flags=8843<UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST> metric 0 mtu 1500
        options=8<VLAN_MTU>
        ether 00:0e:2e:2d:aa:a1
        inet 94.237.82.xxx netmask 0xfffffc00 broadcast 94.237.83.255
        media: Ethernet autoselect (100baseTX <full-duplex>)
        status: active
xl0: flags=8843<UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST> metric 0 mtu 1500
        options=9<RXCSUM,VLAN_MTU>
        ether 00:50:04:af:97:b0
        inet 192.168.0.1 netmask 0xffffff00 broadcast 192.168.0.255
        media: Ethernet 100baseTX <full-duplex>
        status: active
plip0: flags=108810<POINTOPOINT,SIMPLEX,MULTICAST,NEEDSGIANT> metric 0 mtu 1500
lo0: flags=8049<UP,LOOPBACK,RUNNING,MULTICAST> metric 0 mtu 16384
        inet6 fe80::1%lo0 prefixlen 64 scopeid 0x5
        inet6 ::1 prefixlen 128
        inet 127.0.0.1 netmask 0xff000000
pflog0: flags=141<UP,RUNNING,PROMISC> metric 0 mtu 33204

It has stopped now thou, i wondered myself that lo0 (192.168.0.1) too. Maybe it was someone´s LAN IP leaking or something...

[jggimi]

This MAC address, 00:21:91:72:14:64, is external to your system, and was in the ARP messages you were receiving. Your routing table might tell you the offending IP address. ($ netstat -rnf inet)

[jggimi]

Woops. Forgot about the arp(8) command.