Odd console messages when ethernet cable is NOT connected

Question

Level 1

10 points

Odd console messages when ethernet cable is NOT connected

Summary: 3 Symptoms, all recurs simultaneously every minute or so when an ethernet cable is NOT connected:
1) Console: *"Firewall krb5kdc is listening"*...
2) HardwareGrowler *"Ethernet Deactivated Interface: en0"*
3) Network Preference Panel: Ethernet panel flickers. The Status changes from *"Cable Unplugged"* to *"Unknown State"* and then back to *"Cable Unplugged"* in less than a second.

I just bought a new 17" MacBook Pro (2010) to replace my old white MacBook that was running Snow Leopard. I used the migration assistant to transfer everything on the first bootup.

I use Growl and HardwareGrowl, which basically just alerts me to system changes such as mounting drives, connected and disconnected to networks, etc. I noticed that almost every minute I would see two identical consecutive Growl notifications pop up: *"Ethernet Deactivated Interface: en0"*.

Also, at the same exact time as the Growl notification this would print in the Console Log:
-----
4/20/10 11:35:24 PM Firewall[44305] krb5kdc is listening from :::88 proto=6
4/20/10 11:35:24 PM Firewall[44305] krb5kdc is listening from 0.0.0.0:88 proto=6

Then Oddly enough, if I leave the Network Preference Pane open, I can see the ethernet status go from its normal *"Cable Unplugged"* to *"Unknown State"* then in a fraction of a second, back to *"Cable Unplugged"*.

Weird, right!

The messages will stop if I insert a network cable into the MacBook Pro. The messages appear regardless of whether Airport is on. The messages even appear when there is no network cable and Airport is disabled.

I never saw this behavior on my old Macbook.

I went ahead and uninstalled Growl and a few other apps that mess with the networking (such as VMWare). I also created a 'virgin' test account. I am still having these entries show up in the log.

*I'm concerned that this may be a hardware issue. Does anyone have idea what may be going on?*

Sample log output:
------------------
4/20/10 11:36:35 PM Firewall[44305] krb5kdc is listening from :::88 proto=6
4/20/10 11:36:35 PM Firewall[44305] krb5kdc is listening from 0.0.0.0:88 proto=6
4/20/10 11:37:46 PM Firewall[44305] krb5kdc is listening from :::88 proto=6
4/20/10 11:37:46 PM Firewall[44305] krb5kdc is listening from 0.0.0.0:88 proto=6
4/20/10 11:38:56 PM Firewall[44305] krb5kdc is listening from :::88 proto=6
4/20/10 11:38:56 PM Firewall[44305] krb5kdc is listening from 0.0.0.0:88 proto=6
4/20/10 11:40:07 PM Firewall[44305] krb5kdc is listening from :::88 proto=6
4/20/10 11:40:07 PM Firewall[44305] krb5kdc is listening from 0.0.0.0:88 proto=6
4/20/10 11:41:18 PM Firewall[44305] krb5kdc is listening from :::88 proto=6
4/20/10 11:41:18 PM Firewall[44305] krb5kdc is listening from 0.0.0.0:88 proto=6

Activity Monitor:
-----------------
Active Memory: 533.2 MB
Free Memory: 2.40 GB
Wired Memory: 738.8 MB
Used Memory: 1.47 GB
Inactive Memory: 235.6 MB
Total VM: 141.14 GB
Number of processes: 54

PID Process Name User CPU Real Mem Virtual Mem
0 kernel_task root 11.1 141.9 MB 2.31 GB
1 launchd root 0.4 1.3 MB 2.36 GB
10 kextd root 0.6 3.3 MB 2.35 GB
11 DirectoryService root 0.0 5.1 MB 2.36 GB
12 notifyd root 0.0 640 KB 2.35 GB
13 diskarbitrationd root 0.0 1.7 MB 2.35 GB
14 configd root 0.0 3.4 MB 2.38 GB
15 syslogd root 0.0 752 KB 2.36 GB
16 blued root 0.0 4.8 MB 2.37 GB
17 distnoted daemon 0.0 1.4 MB 2.35 GB
20 mDNSResponder _mdnsrespo 0.0 2.0 MB 2.36 GB
23 coreservicesd root 0.1 29.5 MB 2.40 GB
26 securityd root 0.0 3.0 MB 2.36 GB
33 ntpd root 0.0 1.1 MB 2.32 GB
34 krb5kdc root 0.0 2.0 MB 2.34 GB
35 cron root 0.0 900 KB 2.32 GB
37 usbmuxd _usbmuxd 0.0 1.2 MB 608.1 MB
38 SystemStarter root 0.0 1.0 MB 2.34 GB
42 RFBRegisterMDNS root 0.0 1.7 MB 2.33 GB
44 mds root 0.0 70.2 MB 2.91 GB
45 loginwindow test 0.0 8.3 MB 2.65 GB
46 KernelEventAgent root 0.0 1.0 MB 2.34 GB
48 hidd root 0.0 1.5 MB 2.34 GB
49 fseventsd root 0.0 2.3 MB 2.36 GB
51 dynamic_pager root 0.0 796 KB 2.32 GB
57 autofsd root 0.0 1,008 KB 2.33 GB
65 socketfilterfw root 0.0 3.8 MB 2.36 GB
67 WindowServer _windowser 3.8 48.9 MB 2.99 GB
80 cvmsServ root 0.0 844 KB 2.33 GB
95 coreaudiod _coreaudio 0.0 1.8 MB 2.35 GB
115 launchd test 0.0 1.4 MB 2.36 GB
119 Dock test 0.0 28.7 MB 2.67 GB
120 SystemUIServer test 0.0 23.9 MB 2.73 GB
121 Finder test 0.0 13.6 MB 2.66 GB
126 pboard test 0.0 852 KB 2.32 GB
138 fontd test 0.0 4.6 MB 2.40 GB
142 UserEventAgent test 0.0 5.9 MB 2.37 GB
144 AppleVNCServer test 0.0 3.8 MB 2.60 GB
149 SIMBL Agent test 0.0 6.6 MB 10.67 GB
150 PenTabletDriver test 1.6 7.9 MB 2.66 GB
153 LMILaunchAgentFixer test 0.0 2.0 MB 630.7 MB
158 CCacheServer test 0.0 1.7 MB 2.35 GB
163 ConsumerTouchDriver test 0.3 6.7 MB 2.64 GB
165 TabletDriver test 0.0 5.3 MB 2.63 GB
192 Activity Monitor test 9.0 24.8 MB 2.74 GB
194 cvmsComp x8664 test 0.0 6.4 MB 2.34 GB
195 activitymonitord root 0.5 1.2 MB 2.33 GB
197 Console test 0.1 21.1 MB 2.69 GB
206 mdworker Patrick 0.0 6.0 MB 2.37 GB
208 mdworker test 0.0 9.6 MB 2.37 GB
218 DashboardClient test 0.0 21.1 MB 4.68 GB
234 Safari test 0.0 162.6 MB 5.02 GB
237 ocspd root 0.0 1.9 MB 2.37 GB
238 WebKitPluginAgent test 0.0 1,016 KB 2.35 GB

Message was edited by: bearboykahlo

Macbook Pro 2.53GHz, Mac OS X (10.6.3)

Posted on Apr 20, 2010 10:50 PM

Reply

Answer 1

Rod Hagen

Level 7

32,000 points

Apr 20, 2010 11:09 PM in response to bearboykahlo

Hio bearboykahlo,

Don't worry, it is not martians plugging in an invisible cord of their own (though it can seem a bit like that! ).

It is just your own OS's "Kerberos version 5 Authentication Service and Key Distribution Center" (krb5kdc)

For a good explanation see http://discussions.apple.com/message.jspa?messageID=6739752#6739752

I suspect it is occurring because of a "ticket" granted to your old white MB during the migration process.

see also http://www.radiotope.com/content/more-about-os-x-105-leopard-kerberos

Cheers

Rod

Reply

Answer 2

bearboykahlo Author

Level 1

10 points

Apr 20, 2010 11:15 PM in response to Rod Hagen

Rod, I was adding some more detail when you answered this. I have a passing understanding of what Kerberos is, and I realize that is what the log is referring to. However I think it is a symptom and not a cause of the problem. For example why would the status go to "Unknown State" in the Network Preference pane every minute?

Reply

Answer 3

Rod Hagen

Level 7

32,000 points

Apr 20, 2010 11:43 PM in response to bearboykahlo

My bet is that this is a software matter rather than hardware related and that you simply seeing the logging of repeated "testing" of the port as a result of the "ticket" every 70 seconds to see whether a cable has, in fact , been reconnected to it. Without checking, the status of the port is "unknown".

How long has the process been going on for?

The manipulation of kerberos has changed somewhat with Snow Leopard, and I'm afraid I know only a very little about it myself. I guess another issue may be that something that you have migrated across is giving it indigestion? The old "kerberos.app" in System/Library/CoreServices has been renamed 'Ticket Viewer' (it is still in the same folder). Might be worth seeing if any tickets are active?

Cheers

Rod

Reply

Answer 4

bearboykahlo Author

Level 1

10 points

Apr 21, 2010 6:31 AM in response to Rod Hagen

Ticket Viewer shows nothing that I can see. Is there anything else I can check?

I just thought the krb5 message in the log was a symptom of the network resetting/initializing/whatever. Although it is odd that its the only message that shows.

I only bought the laptop last week. It's been happening the entire time I believe. Both machines were running the current version of Snow Leopard before I ran the Migration Assistant.

Any other ideas? Thanks for the help!

Reply

Answer 5

bearboykahlo Author

Level 1

10 points

Apr 21, 2010 5:09 PM in response to bearboykahlo

I reinstalled 10.6 via the included Install DVD to an external drive to see what happens on a virgin install.

Oddly the krb5 messages do not appear, however the Network Preference Pane status still flickers and if I install Growl I still see the Ethernet Deactivated notifications. This must either be an Snow Leopard bug or a hardware problem. I'm going to setup a service appointment at this point I think.

Reply

Answer 6

Rod Hagen

Level 7

32,000 points

Apr 21, 2010 5:18 PM in response to bearboykahlo

Thanks for the update, bearboykahlo. Sounds like a wise course under the circumstances.

Certainly be interesting to know what they have to say.

(edit - just by the way, do you have "Back to My Mac" enabled? see http://discussions.apple.com/thread.jspa?threadID=1468639&tstart=0 )

Cheers

Rod

Reply

Answer 7

JavaGeek

Level 1

22 points

Apr 22, 2010 9:21 AM in response to Rod Hagen

I started seeing the same behavior on my new MacBook Pro i7 (15") after I connected to the Airport Extreme station. I don't see any problems in the log files, but HardwareGrowl shows "Ethernet deactivated: en0" twice every 70 seconds (I timed it).

It seems another friend also has the same issue on his i7 17" MBP. He does get log errors, though, with configd reporting that the network changed (also every 70 seconds).

Right now to me it is only an annoyance since everything seems working fine except for the growl messages. Could it be a spec design change or something else that forces the ethernet port to deactivate? The perfect timing of the deactivation issues makes it look like it was intentional. Maybe an Apple engineer can explain it or figure out if something is wrong with these clues?

Reply

Answer 8

bearboykahlo Author

Level 1

10 points

Apr 22, 2010 9:28 AM in response to JavaGeek

Thanks for the info JavaGeek! I'm glad I'm not the only one. I have an appointment at the Genius Bar tonight, I'll let you know what happens.

I was sad that I might have to exchange my MacBook Pro. But if this is a design issue (hopefully software/firmware) then I can just wait for the fix! It really is cosmetic, but I just wanted to make sure there was nothing wrong with my hardware.

Reply

Answer 9

Apr 22, 2010 9:52 AM in response to bearboykahlo

Yep... same issue here with 15" 2010 MBP. I called Apple and told them about the configd log messages "network configuration has changed" filling the log every 70 seconds. They told me to send it back and are shipping me a new one. Problem only happens when connected wirelessly. When connected via ethernet, the problem goes away. My bets are the new one has the problem too. So much for first generation MBPs, eh? 😉 We are the true beta testers 😉

Reply

Answer 10

Apr 22, 2010 9:53 AM in response to bearboykahlo

Add one more to the list of people with this observation: same configuration (no wired Ethernet, AirPort on) and an annoying Growl message every 70 seconds.

Reply

Answer 11

ciurana

Level 1

0 points

Apr 22, 2010 10:08 AM in response to bearboykahlo

Same problem here, new unibody MacBook Pro 15".

Here is a quick workaround:

1. Open a terminal.
2. sudo ifconfig en0 down

This will disable the NIC but will leave it listed for the current configuration in System Preferences/Network.

I'm on the phone with Apple figuring out if it's something that they will fix with a software patch or whether it's absolutely necessary to return the machine.

Cheers!

pr3d4t0r

Reply

Answer 12

ciurana

Level 1

0 points

Apr 22, 2010 2:40 PM in response to bearboykahlo

Update after spending a long time on the phone with several Apple technicians.

These comments apply to MacBook Pro 15" i7 - your mileage will vary. My symptoms were that HwG reports the Ethernet device reset every 70 seconds, but the system log and other files in /var/log do not. My other symptom was that the Ethernet item in System Preferences/Network/current profile flashed off/on every 70 seconds, just an instant before HwG notified.

Here is what we did:

1. Reset SMC Memory.
2. Reset the MacBook Pro to factory settings.

In these two scenarios, the HwG and the profile Ethernet blink continued every 70 seconds, like clockwork.

3. Start the MacBook Pro in Safe Mode (hold the left Shift key while powering on; keep it pressed until you see the progress bar under the grey Apple logo), then open HwG and the current networking profile.

In this case the notifications and off/on flashing stopped. They don't appear again for as long as the machine is running in safe mode. Plugging an Ethernet cable allows networking just fine.

Our friendly Apple techs reported then that they don't believe this is a hardware issue. Most likely it's something that loads at startup that creates the conflict; could it be HwG itself? Little Snitch? Also, the internal incident reports from Apple don't show any issues with the Ethernet port at this time. Given that we spent 3 hours working on this and I got to speak with four different techs, each with an increasing level of experience, I tend to heed their advise. They don't believe it's a hardware issue, thus reducing the chances of having to exchange a new MacBook for this reason alone.

Try the safe mode test in your MacBook. If the issue doesn't crop up again wait for the software patch. If it does even in safe mode then it's probably a good idea to bring the machine back to Apple (their advise which I'm just echoing).

In the meantime I turned off HwG (I wasn't using it anyway - just installed it for testing this). If I need it, I'll ifconfig en0 down like I indicated in my previous post to disable the Ethernet port messages.

The MacBook is now operating normally (with the ifconfig en0 down) and otherwise performing as expected. No networking issues here. Your mileage will vary.

Special thanks to Mr. S - my senior tech support contact for the best part of an hour over Apple Care. You rock, dude!

Cheers!

pr3d4t0r
http://eugeneciurana.com

Reply

Answer 13

bearboykahlo Author

Level 1

10 points

Apr 22, 2010 2:54 PM in response to ciurana

Thanks for the update ciurara. I guess I should cancel my appointment today instead of wasting time!

However I did do a completely clean reinstall and still have the same issue. So it shouldn't be due to 3rd party software such as Little Snitch.

Did the techs you spoke to have any idea about how widespread this issue is? Does it affect all new i5 or i7 macbooks?

Reply

Answer 14

ciurana

Level 1

0 points

Apr 22, 2010 4:13 PM in response to bearboykahlo

bearboykahlo wrote:

Did the techs you spoke to have any idea about
how widespread this issue is? Does it affect
all new i5 or i7 macbooks?

The general consensus is that it isn't a widespread issue yet. I spoke with four or five techs (I can't recall anymore) over a 3-hour period troubleshooting and fixing this. The last guy I spoke with seemed very knowledgeable and has a copy of this forum's posts now that I sent him by email. I'll call him Mr. S because I promised not to post his email address/name to avoid getting him flooded with support emails without a ticket.

Mr. S indicated that the issue has not come in their internal issues book. The problem doesn't appear to be widespread. In my case, I didn't even notice it until I ran HwG because there is no symptom in any of the /var/log files. Mr. S also indicated that there are Apple engineers whose job is to scan these forums and to identify patterns and escalate issues in a timely manner.

I bought my MacBook Pro last week from an Apple Store in San Francisco. Another solution he offered was to head to the store, bring a copy of the incident ID, and try monitoring with one of the new MBPs at the store after exchanging my current one. I discarded that as a solution in my case for various reasons, but the technical one was starting the MBP in safe mode allowed for both wifi and Ethernet access without issues, and the Ethernet/HwG off/on symptom went away. As you saw earlier, I have a workaround set up as well for when the machine starts up normally.

Mr. S's recap was:

1. Try in safe mode and assume that, if all is well, it's a software issue in an upper layer and just wait for the patch if there is a workaround and I can live with the en0 bouncing (I can).

2. If you can't live with it, take the MacBook to the store and exchange it after testing the same setup in a different machine there.

3. If (2) isn't viable because you have some custom option unavailable at the store (e.g. hirez screen) then return the machine to Apple after opening a ticket and having them schedule a FedEx pick up, etc. This carries the risk that, since the issue isn't widespread yet or identified, you may get a new machine with the ill behaviour anyway.

Per Mr. S's suggestion, my ticket remains open and I will continue to monitor my MBP. I'll post more news if I find out anything else.

Cheers!

pr3d4t0r
http://ciurana.eu

Reply

Answer 15

jkr801

Level 1

0 points

Apr 22, 2010 4:32 PM in response to bearboykahlo

Just got a new 2010 15" Macbook Pro and I transferred everything from my old macbook pro to the new one and hardware growler keeps doing this as well.

Reply