We have a box that's just started acting up and we're not really sure why. It has IP address (dummy examples) 18.104.22.168 on eth0, 127.0.0.2 on eth1, and 22.214.171.124 on eth1:0.
Recently, for some reason, eth0 has started sending gratuitous arps claiming 126.96.36.199. This causes all kinds of havoc for traffic going to 188.8.131.52 that we need routed through eth1. I was reading up on arp flux but it doesn't seem like it's the problem since as far as I understand, that's only replies to arp requests, not gratuitous arps. Not seeing anything obvious in processes that's sending those gratuitous arps.
My question is, is there any way to figure out what's sending those requests? Something like
netstat -p but for arp?
This is a box running Linux w/kernel 2.6.18.