Funky arp problem

[Mike Lovell]

Kenny Long wrote:
> Mike,
>
> Will you provide us with a bit more information?  How many of these
> misbehaving servers do you have?  Are they all on the same broadcast or
> switching domain or are they on different networks separated by routers?  Do
> they all start up the problem at the same exact time?  Do you have an
> unmanaged or managed switch that these are plugged into?  When the problem
> occurs, run a "tcpdump -i eth0 -vvvn" where eth0 is the NIC in question.
> Then try to ping the server in question from another box on the network, and
> see if the server in question is receiving the ARP requests.  If its not, it
> wouldnt seem likely the problem belongs to the server, but elsewhere in the
> network.  If you are seeing the ARP requests but your server is not
> responding to them, then we can work from there.
>
>   
There are a total of 4 machines that I have seen this problem on. They 
are in different broadcast domains and completely different datacenters. 
3 are running Linux but I messed with those a while ago and I haven't 
seen the problem lately on them. Or at least no one has complained. :)

The one that is causing problems is the one Windows box. I installed 
Wireshark on it and started watching the interface for ARP packets. When 
the machine was unresponsive from other machines, I tried arping'ing it 
and there were no ARP packets seen on the interface. I opened firefox 
and it went to is default home page. When I did this, I saw the ARP 
packets that were generated by the box and the responses from the 
network. So what it is looking like is that the network is not sending 
the ARP 'Who Has' broadcast packets down the link to this box. I'll need 
to bug the net admins about this. The network is pretty much all Cisco 
catalyst gear. I don't have the ability to get into the switches and 
routers to see what traffic is going across the links. But I will get 
someone to look at that.

Thanks for the suggestion on where to look. I should have thought of 
that sooner.

Mike