Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

We have a box that's just started acting up and we're not really sure why. It has IP address (dummy examples) 199.199.199.1 on eth0, 127.0.0.2 on eth1, and 199.199.199.2 on eth1:0.

Recently, for some reason, eth0 has started sending gratuitous arps claiming 199.199.199.2. This causes all kinds of havoc for traffic going to 199.199.199.2 that we need routed through eth1. I was reading up on arp flux but it doesn't seem like it's the problem since as far as I understand, that's only replies to arp requests, not gratuitous arps. Not seeing anything obvious in processes that's sending those gratuitous arps.

My question is, is there any way to figure out what's sending those requests? Something like netstat -p but for arp?

This is a box running Linux w/kernel 2.6.18.

share|improve this question

2 Answers 2

Are those two addresses on the same subnet, as your example implies? Are by chance the two network cards connected to the same switch, too?

Then this could very well be confusing the box's TCP/IP stack...

share|improve this answer
    
Yeah, same subnet, same switch. In reading about arp flux it does seem like this isn't a great configuration, but everything has worked fine until now. –  KernelM Oct 21 '10 at 18:19

Sounds like youre running a classic virtual server setup. Put the following 2 options in /etc/sysctl.conf and then run sysctl -p

net.ipv4.conf.all.arp_announce = 2
net.ipv4.conf.all.arp_ignore = 1

These will prevent the box from sending any arps out an interface for an IP that is not the primary of that interface.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.