Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > comp.os.linux.networking > #3222

Re: Strange ARP flood

Show all headers | View raw

On Mon, 19 Jan 2015 14:13:54 +0200, Tauno Voipio
<tauno.voipio@notused.fi.invalid> wrote:

> On 19.1.15 12:13, pk wrote:
> > On Sat, 17 Jan 2015 08:15:13 +0200, detha <detha@foad.co.za> wrote:
> >
> >>>> Are you running (R)STP ?
> >>>
> >>> I'm running RSTP. It doesn't look like an STP loop thing, since if I
> >>> isolate the offending machine from the network the flood stops. If it
> >>> were a topology/loop problem, it wouldn't stop unless the loop would
> >>> be physically broken.
> >>
> >> Correct. However it looks like some form of gratuitous ARP, amplified
> >> through a broadcast loop. Could it be a buggy network stack that
> >> triggers some interaction between the client and the AP that
> >> re-broadcasts it?
> >
> > Uhm, AFAIK gratuitous ARPs are essentially ARP replies, while here we're
> > seeing ARP requests.
> >
> > However, I certainly can't exclude a buggy OS, especially since we're
> > talking Apple here (see below).
> 
> 
> No - GARP is a request for own IP [1]. The idea is to invite response
> from some other host having the same IP, to avoid collisions.

I see now that both methods are in use, so here we're seeing gratuitous
_requests_ (which, contrary to my wrong understanding, seems indeed to be
the preferred choice). You are right, thanks for the clarification.

It seems both methods are in use, see eg

http://wiki.wireshark.org/Gratuitous_ARP
http://kb.juniper.net/InfoCenter/index?page=content&id=KB24349

or wikipedia:

"ARP may also be used as a simple announcement protocol. This is useful for
updating other hosts mapping of a hardware address when the senders IP
address or MAC address has changed. Such an announcement, also called a
gratuitous ARP message, is usually broadcast as an ARP request containing
the senders protocol address (SPA) in the target field (TPA=SPA), with the
target hardware address (THA) set to zero. An alternative is to broadcast
an ARP reply with the sender's hardware and protocol addresses (SHA and
SPA) duplicated in the target fields (TPA=SPA, THA=SHA).

An ARP announcement is not intended to solicit a reply; instead it updates
any cached entries in the ARP tables of other hosts that receive the
packet. The operation code may indicate a request or a reply because the
ARP standard specifies that the opcode is only processed after the ARP
table has been updated from the address fields."
 
> The GARP's are probably belonging to Apple Rendezvous (Zeroconf)
> protocol looking for an address to use, when the host has no other
> useful address. Are they for 169.254.x.y?

No, they are for the host's own IP address, but thanks for mentioning
zeroconf which gives further ideas for investigation.

Back to comp.os.linux.networking | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

Strange ARP flood pk <pk@pk.invalid> - 2015-01-13 18:56 +0100
  Re: Strange ARP flood Aleksandar Kuktin <akuktin@gmail.com> - 2015-01-13 19:44 +0000
    Re: Strange ARP flood pk <pk@pk.invalid> - 2015-01-14 10:26 +0100
  Re: Strange ARP flood detha <detha@foad.co.za> - 2015-01-14 21:36 +0200
    Re: Strange ARP flood pk <pk@pk.invalid> - 2015-01-16 10:03 +0100
      Re: Strange ARP flood detha <detha@foad.co.za> - 2015-01-17 08:15 +0200
        Re: Strange ARP flood pk <pk@pk.invalid> - 2015-01-19 11:13 +0100
          Re: Strange ARP flood Tauno Voipio <tauno.voipio@notused.fi.invalid> - 2015-01-19 14:13 +0200
            Re: Strange ARP flood pk <pk@pk.invalid> - 2015-01-19 13:34 +0100
  Re: Strange ARP flood Ralph Spitzner <rasp@spitzner.org> - 2015-01-15 10:12 +0100
    Re: Strange ARP flood pk <pk@pk.invalid> - 2015-01-16 10:01 +0100

csiph-web