Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > comp.os.linux.networking > #3206

Re: Strange ARP flood

Show all headers | View raw

On Tue, 13 Jan 2015 18:56:26 +0100, pk wrote:

> (Asking here for lack of a better newsgroup; direct me as appropriate if
> I'm wrong)
> 
> The network is a mixture of physical ethernet switches and wireless AP,
> everything is in the same broadcast domain (please no comments about
> this).
> 
> From time to time, we see a flood of strange ARP frames, every time it's
> a single machine that's flooding, for example like this:
> 
> 18:23:44.326912 3c:15:c2:c8:cb:11 > ff:ff:ff:ff:ff:ff, ethertype ARP
> (0x0806), length 60: Ethernet (len 6), IPv4 (len 4), Request who-has
> 10.15.10.251 (ff:ff:ff:ff:ff:ff) tell 10.15.10.251, length 46
> 18:23:44.326967 3c:15:c2:c8:cb:11 > ff:ff:ff:ff:ff:ff, ethertype ARP
> (0x0806), length 60: Ethernet (len 6), IPv4 (len 4), Request who-has
> 10.15.10.251 (ff:ff:ff:ff:ff:ff) tell 10.15.10.251, length 46
> 18:23:44.327021 3c:15:c2:c8:cb:11 > ff:ff:ff:ff:ff:ff, ethertype ARP
> (0x0806), length 60: Ethernet (len 6), IPv4 (len 4), Request who-has
> 10.15.10.251 (ff:ff:ff:ff:ff:ff) tell 10.15.10.251, length 46 ...
> 
> In this case, the machine at 3c:15:c2:c8:cb:11 happens to be an Apple
> laptop connected to the wifi, which indeed has (already) the IP address
> 10.15.10.251. Tearing down the wireless connection end re-enabling it
> makes the traffic disappear.
> 
> A quick audit of the laptop while the flood is happening does not reveal
> any special or strange application running.
> 
> The same happens from time to time to other devices (the great majority
> of times they were Apple laptopos, but we've seen other devices as well,
> namely a few mobile phones). They're always devices connected to the
> wifi;
> we've never seen the flood coming from wired devices.
> 
> Any ideas what could be causing this?

Triplets of ARP similar to what you describe (but with a larger 
interpacket gap, I think) are used by Windows to check the availability 
of an IP address before binding to it.

Missing from your description is a more detailed account of the flood. 
How many packets in a flood? Time delta between packets in a flood, 
distance in time between two floods and so on.

It could just be that the host is trying to bind to an IP address but has 
problems with it. This can be tested by looking at address timeouts given 
by DHCP and trying to correlate them with floods.

Back to comp.os.linux.networking | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

Strange ARP flood pk <pk@pk.invalid> - 2015-01-13 18:56 +0100
  Re: Strange ARP flood Aleksandar Kuktin <akuktin@gmail.com> - 2015-01-13 19:44 +0000
    Re: Strange ARP flood pk <pk@pk.invalid> - 2015-01-14 10:26 +0100
  Re: Strange ARP flood detha <detha@foad.co.za> - 2015-01-14 21:36 +0200
    Re: Strange ARP flood pk <pk@pk.invalid> - 2015-01-16 10:03 +0100
      Re: Strange ARP flood detha <detha@foad.co.za> - 2015-01-17 08:15 +0200
        Re: Strange ARP flood pk <pk@pk.invalid> - 2015-01-19 11:13 +0100
          Re: Strange ARP flood Tauno Voipio <tauno.voipio@notused.fi.invalid> - 2015-01-19 14:13 +0200
            Re: Strange ARP flood pk <pk@pk.invalid> - 2015-01-19 13:34 +0100
  Re: Strange ARP flood Ralph Spitzner <rasp@spitzner.org> - 2015-01-15 10:12 +0100
    Re: Strange ARP flood pk <pk@pk.invalid> - 2015-01-16 10:01 +0100

csiph-web