Funky arp problem
mike at dev-zero.net
Thu Mar 26 12:49:49 MDT 2009
Mike Lovell wrote:
> There are a total of 4 machines that I have seen this problem on. They
> are in different broadcast domains and completely different
> datacenters. 3 are running Linux but I messed with those a while ago
> and I haven't seen the problem lately on them. Or at least no one has
> complained. :)
> The one that is causing problems is the one Windows box. I installed
> Wireshark on it and started watching the interface for ARP packets.
> When the machine was unresponsive from other machines, I tried
> arping'ing it and there were no ARP packets seen on the interface. I
> opened firefox and it went to is default home page. When I did this, I
> saw the ARP packets that were generated by the box and the responses
> from the network. So what it is looking like is that the network is
> not sending the ARP 'Who Has' broadcast packets down the link to this
> box. I'll need to bug the net admins about this. The network is pretty
> much all Cisco catalyst gear. I don't have the ability to get into the
> switches and routers to see what traffic is going across the links.
> But I will get someone to look at that.
So I finally got a solution to this problem and figured I would share
with the list. The problem ended up being a driver issue. For some
reason, the driver for the nics was filtering arp broadcast packets
before they made it up the stack. I tried Debian Etch for 32 and 64 bit.
On both, when using the stock 2.6.18 kernel, tcpdump didn't show any arp
packets making it to the system. I had the network admin check the
packets going across the port and the arps were there. Upgrading to
2.6.24 or 2.6.26 fixed the problem and tcpdump started showing arp
requests and responses going across the interface. I had this problem in
Windows as well on XP. But even weirder here. The drivers for the 32
versions of Windows didn't have this problem. But the 64 bit versions
did. So I guess the 64 bit drivers haven't fixed the problem.
Probably useless info for most of you. But hopefully I can save someone
the trouble in the future.
More information about the PLUG