Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > comp.os.linux.networking > #3212

Re: Strange ARP flood

Show all headers | View raw

On Wed, 14 Jan 2015 21:36:33 +0200, detha <detha@foad.co.za> wrote:

> On Tue, 13 Jan 2015 18:56:26 +0100, pk wrote:
> 
> > (Asking here for lack of a better newsgroup; direct me as appropriate if
> > I'm wrong)
> > 
> > The network is a mixture of physical ethernet switches and wireless AP,
> > everything is in the same broadcast domain (please no comments about
> > this).
> > 
> > From time to time, we see a flood of strange ARP frames, every time
> > it's a single machine that's flooding, for example like this:
> > 
> > 18:23:44.326912 3c:15:c2:c8:cb:11 > ff:ff:ff:ff:ff:ff, ethertype ARP
> > (0x0806), length 60: Ethernet (len 6), IPv4 (len 4), Request who-has
> > 10.15.10.251 (ff:ff:ff:ff:ff:ff) tell 10.15.10.251, length 46
> > 18:23:44.326967 3c:15:c2:c8:cb:11 > ff:ff:ff:ff:ff:ff, ethertype ARP
> > (0x0806), length 60: Ethernet (len 6), IPv4 (len 4), Request who-has
> > 10.15.10.251 (ff:ff:ff:ff:ff:ff) tell 10.15.10.251, length 46
> > 18:23:44.327021 3c:15:c2:c8:cb:11 > ff:ff:ff:ff:ff:ff, ethertype ARP
> > (0x0806), length 60: Ethernet (len 6), IPv4 (len 4), Request who-has
> > 10.15.10.251 (ff:ff:ff:ff:ff:ff) tell 10.15.10.251, length 46 ...
> > 
> > In this case, the machine at 3c:15:c2:c8:cb:11 happens to be an Apple
> > laptop connected to the wifi, which indeed has (already) the IP address
> > 10.15.10.251. Tearing down the wireless connection end re-enabling it
> > makes the traffic disappear.
> 
> How sure are you that there are no loops in the topology?

No loops.
 
> Are you running (R)STP ?

I'm running RSTP. It doesn't look like an STP loop thing, since if I
isolate the offending machine from the network the flood stops. If it were
a topology/loop problem, it wouldn't stop unless the loop would be
physically broken.

Back to comp.os.linux.networking | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

Strange ARP flood pk <pk@pk.invalid> - 2015-01-13 18:56 +0100
  Re: Strange ARP flood Aleksandar Kuktin <akuktin@gmail.com> - 2015-01-13 19:44 +0000
    Re: Strange ARP flood pk <pk@pk.invalid> - 2015-01-14 10:26 +0100
  Re: Strange ARP flood detha <detha@foad.co.za> - 2015-01-14 21:36 +0200
    Re: Strange ARP flood pk <pk@pk.invalid> - 2015-01-16 10:03 +0100
      Re: Strange ARP flood detha <detha@foad.co.za> - 2015-01-17 08:15 +0200
        Re: Strange ARP flood pk <pk@pk.invalid> - 2015-01-19 11:13 +0100
          Re: Strange ARP flood Tauno Voipio <tauno.voipio@notused.fi.invalid> - 2015-01-19 14:13 +0200
            Re: Strange ARP flood pk <pk@pk.invalid> - 2015-01-19 13:34 +0100
  Re: Strange ARP flood Ralph Spitzner <rasp@spitzner.org> - 2015-01-15 10:12 +0100
    Re: Strange ARP flood pk <pk@pk.invalid> - 2015-01-16 10:01 +0100

csiph-web