Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Hello and excuse me for my English please. ;-)

Two server seems to be involved with this problem. Our DC (domain controller, 2003) an the VMware VC-Server (2008 R2). After capture "some" network trafic i discovered, that the DC is sending GARP request with the following syntax. Logging was done with Wireshark by hanging direct to the server network interface. So no switch or other network devices are logged.

Sender MAC address: [DC-MAC]
Sender IP address: [VC-IP]
Target MAC address: 00:00:00_00:00:00 (00:00:00:00:00:00)
Target IP address: [VC-IP]

In my opinion thats false. Because the sender of GARP request adds his "sender's protocol address (SPA) in the target field (TPA=SPA), with the target hardware address (THA) set to zero". The pakets definitely comes from the DC, but have the VC's IP in the sender/target field.

This behavior cause packet loss to the VC Server. But only from Linux Maschines. On Linux a dublicate ARP Cache entry appear like this. On windows everything is fine.

What's wrong here? It is making me crazy.

share|improve this question

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.