Funky arp problem

[Mike Lovell]

Mike Lovell wrote:
> There are a total of 4 machines that I have seen this problem on. They 
> are in different broadcast domains and completely different 
> datacenters. 3 are running Linux but I messed with those a while ago 
> and I haven't seen the problem lately on them. Or at least no one has 
> complained. :)
>
> The one that is causing problems is the one Windows box. I installed 
> Wireshark on it and started watching the interface for ARP packets. 
> When the machine was unresponsive from other machines, I tried 
> arping'ing it and there were no ARP packets seen on the interface. I 
> opened firefox and it went to is default home page. When I did this, I 
> saw the ARP packets that were generated by the box and the responses 
> from the network. So what it is looking like is that the network is 
> not sending the ARP 'Who Has' broadcast packets down the link to this 
> box. I'll need to bug the net admins about this. The network is pretty 
> much all Cisco catalyst gear. I don't have the ability to get into the 
> switches and routers to see what traffic is going across the links. 
> But I will get someone to look at that.
>
So I finally got a solution to this problem and figured I would share 
with the list. The problem ended up being a driver issue. For some 
reason, the driver for the nics was filtering arp broadcast packets 
before they made it up the stack. I tried Debian Etch for 32 and 64 bit. 
On both, when using the stock 2.6.18 kernel, tcpdump didn't show any arp 
packets making it to the system. I had the network admin check the 
packets going across the port and the arps were there. Upgrading to 
2.6.24 or 2.6.26 fixed the problem and tcpdump started showing arp 
requests and responses going across the interface. I had this problem in 
Windows as well on XP. But even weirder here. The drivers for the 32 
versions of Windows didn't have this problem. But the 64 bit versions 
did. So I guess the 64 bit drivers haven't fixed the problem.

Probably useless info for most of you. But hopefully I can save someone 
the trouble in the future.

Mike