Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > comp.os.linux.networking > #3220

Re: Strange ARP flood

Show all headers | View raw

On Sat, 17 Jan 2015 08:15:13 +0200, detha <detha@foad.co.za> wrote:

> >> Are you running (R)STP ?
> > 
> > I'm running RSTP. It doesn't look like an STP loop thing, since if I
> > isolate the offending machine from the network the flood stops. If it
> > were a topology/loop problem, it wouldn't stop unless the loop would be
> > physically broken.
> 
> Correct. However it looks like some form of gratuitous ARP, amplified
> through a broadcast loop. Could it be a buggy network stack that triggers
> some interaction between the client and the AP that re-broadcasts it?

Uhm, AFAIK gratuitous ARPs are essentially ARP replies, while here we're
seeing ARP requests.

However, I certainly can't exclude a buggy OS, especially since we're
talking Apple here (see below).

 
> Which leads to: 'Does it always happen with a particular client, or with a
> particular client OS?' and 'Does it always happen when the client is
> connected to a particular AP, or to a particular brand AP?'

So far all the cases have been wirelessly connected Apple laptops,
connected to different APs (so it doesn't look like something specific of
a particular AP).

At this point, next step will be detailed analysis of an offending machine
while the flood is happening.

Thanks for your suggestions.

Back to comp.os.linux.networking | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

Strange ARP flood pk <pk@pk.invalid> - 2015-01-13 18:56 +0100
  Re: Strange ARP flood Aleksandar Kuktin <akuktin@gmail.com> - 2015-01-13 19:44 +0000
    Re: Strange ARP flood pk <pk@pk.invalid> - 2015-01-14 10:26 +0100
  Re: Strange ARP flood detha <detha@foad.co.za> - 2015-01-14 21:36 +0200
    Re: Strange ARP flood pk <pk@pk.invalid> - 2015-01-16 10:03 +0100
      Re: Strange ARP flood detha <detha@foad.co.za> - 2015-01-17 08:15 +0200
        Re: Strange ARP flood pk <pk@pk.invalid> - 2015-01-19 11:13 +0100
          Re: Strange ARP flood Tauno Voipio <tauno.voipio@notused.fi.invalid> - 2015-01-19 14:13 +0200
            Re: Strange ARP flood pk <pk@pk.invalid> - 2015-01-19 13:34 +0100
  Re: Strange ARP flood Ralph Spitzner <rasp@spitzner.org> - 2015-01-15 10:12 +0100
    Re: Strange ARP flood pk <pk@pk.invalid> - 2015-01-16 10:01 +0100

csiph-web