Hello and excuse me for my English please. ;-)
Two server seems to be involved with this problem. Our DC (domain controller, 2003) an the VMware VC-Server (2008 R2). After capture "some" network trafic i discovered, that the DC is sending GARP request with the following syntax. Logging was done with Wireshark by hanging direct to the server network interface. So no switch or other network devices are logged.
Sender MAC address: [DC-MAC]
Sender IP address: [VC-IP]
Target MAC address: 00:00:00_00:00:00 (00:00:00:00:00:00)
Target IP address: [VC-IP]
In my opinion thats false. Because the sender of GARP request adds his "sender's protocol address (SPA) in the target field (TPA=SPA), with the target hardware address (THA) set to zero". The pakets definitely comes from the DC, but have the VC's IP in the sender/target field.
This behavior cause packet loss to the VC Server. But only from Linux Maschines. On Linux a dublicate ARP Cache entry appear like this. On windows everything is fine.
What's wrong here? It is making me crazy.