Funky arp problem
mike at dev-zero.net
Tue Mar 17 14:14:18 MDT 2009
Kenny Long wrote:
> Will you provide us with a bit more information? How many of these
> misbehaving servers do you have? Are they all on the same broadcast or
> switching domain or are they on different networks separated by routers? Do
> they all start up the problem at the same exact time? Do you have an
> unmanaged or managed switch that these are plugged into? When the problem
> occurs, run a "tcpdump -i eth0 -vvvn" where eth0 is the NIC in question.
> Then try to ping the server in question from another box on the network, and
> see if the server in question is receiving the ARP requests. If its not, it
> wouldnt seem likely the problem belongs to the server, but elsewhere in the
> network. If you are seeing the ARP requests but your server is not
> responding to them, then we can work from there.
There are a total of 4 machines that I have seen this problem on. They
are in different broadcast domains and completely different datacenters.
3 are running Linux but I messed with those a while ago and I haven't
seen the problem lately on them. Or at least no one has complained. :)
The one that is causing problems is the one Windows box. I installed
Wireshark on it and started watching the interface for ARP packets. When
the machine was unresponsive from other machines, I tried arping'ing it
and there were no ARP packets seen on the interface. I opened firefox
and it went to is default home page. When I did this, I saw the ARP
packets that were generated by the box and the responses from the
network. So what it is looking like is that the network is not sending
the ARP 'Who Has' broadcast packets down the link to this box. I'll need
to bug the net admins about this. The network is pretty much all Cisco
catalyst gear. I don't have the ability to get into the switches and
routers to see what traffic is going across the links. But I will get
someone to look at that.
Thanks for the suggestion on where to look. I should have thought of
More information about the PLUG