Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]
Groups > comp.os.linux.networking > #3221
| From | Tauno Voipio <tauno.voipio@notused.fi.invalid> |
|---|---|
| Newsgroups | comp.os.linux.networking |
| Subject | Re: Strange ARP flood |
| Date | 2015-01-19 14:13 +0200 |
| Organization | A noiseless patient Spider |
| Message-ID | <m9isd4$cte$1@dont-email.me> (permalink) |
| References | <20150113185626.69fb1a36@PC-0511-005.oficinas.atrapalo.com> <54b6c542$0$24902$862e30e2@ngroups.net> <m9ak5s$ets$2@speranza.aioe.org> <54b9fdf1$0$4225$862e30e2@ngroups.net> <m9ilce$i3l$1@speranza.aioe.org> |
On 19.1.15 12:13, pk wrote:
> On Sat, 17 Jan 2015 08:15:13 +0200, detha <detha@foad.co.za> wrote:
>
>>>> Are you running (R)STP ?
>>>
>>> I'm running RSTP. It doesn't look like an STP loop thing, since if I
>>> isolate the offending machine from the network the flood stops. If it
>>> were a topology/loop problem, it wouldn't stop unless the loop would be
>>> physically broken.
>>
>> Correct. However it looks like some form of gratuitous ARP, amplified
>> through a broadcast loop. Could it be a buggy network stack that triggers
>> some interaction between the client and the AP that re-broadcasts it?
>
> Uhm, AFAIK gratuitous ARPs are essentially ARP replies, while here we're
> seeing ARP requests.
>
> However, I certainly can't exclude a buggy OS, especially since we're
> talking Apple here (see below).
No - GARP is a request for own IP [1]. The idea is to invite response
from some other host having the same IP, to avoid collisions.
The GARP's are probably belonging to Apple Rendezvous (Zeroconf)
protocol looking for an address to use, when the host has no other
useful address. Are they for 169.254.x.y?
[1] W. Richard Stevens, TCP/IP Illustrated, Volume 1 The Protocols,
ISBN 0-201-63346-9, pp. 62-63
--
Tauno Voipio
Back to comp.os.linux.networking | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread
Strange ARP flood pk <pk@pk.invalid> - 2015-01-13 18:56 +0100
Re: Strange ARP flood Aleksandar Kuktin <akuktin@gmail.com> - 2015-01-13 19:44 +0000
Re: Strange ARP flood pk <pk@pk.invalid> - 2015-01-14 10:26 +0100
Re: Strange ARP flood detha <detha@foad.co.za> - 2015-01-14 21:36 +0200
Re: Strange ARP flood pk <pk@pk.invalid> - 2015-01-16 10:03 +0100
Re: Strange ARP flood detha <detha@foad.co.za> - 2015-01-17 08:15 +0200
Re: Strange ARP flood pk <pk@pk.invalid> - 2015-01-19 11:13 +0100
Re: Strange ARP flood Tauno Voipio <tauno.voipio@notused.fi.invalid> - 2015-01-19 14:13 +0200
Re: Strange ARP flood pk <pk@pk.invalid> - 2015-01-19 13:34 +0100
Re: Strange ARP flood Ralph Spitzner <rasp@spitzner.org> - 2015-01-15 10:12 +0100
Re: Strange ARP flood pk <pk@pk.invalid> - 2015-01-16 10:01 +0100
csiph-web