Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I have a urgent problem to solve today, but I'm lost. Please help.

I've cloned a Virtual Machine hosted on VM Ware ESXi 4.1
The OS is now Ubuntu Server 12.04 LTS, but at the time of cloning it was 10.04 LTS.

I fixed the MAC address manually inside /etc/udev/rules.d/70-persistent-net.rules. It is a known problem on Ubuntu. I had to remove the old MAC address and set the new one as eth0.

Everything seems to work fine, except ARP. My provider OVH sent me a warning to resolve it today (this is the second day) or they will block my IP!

The log contains many lines like this:

Tue Jun 5 01:04:29 2012 : arp who-has 178.32.136.212 tell 178.32.136.224

where .224 is the cloned server that is causing problems, and .212 is the cloned one.

arp -na returns:

? (178.33.230.254) at 00:07:b4:00:00:02 [ether] on eth0
? (178.32.136.212) at 00:50:56:09:8e:f1 [ether] on eth0

The first IP is the ESXi machine. The second one should not be there.

I'm not an expert and I don't know what else to do to fix this problem. Any help will be very appreciated.

Thanks.

EDIT:

ifcofig on .224:

eth0  Link encap:Ethernet  HWaddr 00:50:56:01:32:c6
      inet addr:178.32.136.224  Bcast:178.32.136.255  Mask:255.255.255.0
      inet6 addr: fe80::250:56ff:fe01:32c6/64 Scope:Link
      UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
      RX packets:399924 errors:0 dropped:465 overruns:0 frame:0
      TX packets:241884 errors:0 dropped:0 overruns:0 carrier:0
      collisions:0 txqueuelen:1000
      RX bytes:58006071 (58.0 MB)  TX bytes:663603166 (663.6 MB)

lo    Link encap:Local Loopback
      inet addr:127.0.0.1  Mask:255.0.0.0
      inet6 addr: ::1/128 Scope:Host
      UP LOOPBACK RUNNING  MTU:16436  Metric:1
      RX packets:516216 errors:0 dropped:0 overruns:0 frame:0
      TX packets:516216 errors:0 dropped:0 overruns:0 carrier:0
      collisions:0 txqueuelen:0
      RX bytes:236284275 (236.2 MB)  TX bytes:236284275 (236.2 MB)

ifconfig on .212:

eth0  Link encap:Ethernet  HWaddr 00:50:56:09:8e:f1
      inet addr:178.32.136.212  Bcast:178.32.136.255  Mask:255.255.255.0
      inet6 addr: fe80::250:56ff:fe09:8ef1/64 Scope:Link
      UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
      RX packets:16014 errors:0 dropped:0 overruns:0 frame:0
      TX packets:14511 errors:0 dropped:0 overruns:0 carrier:0
      collisions:0 txqueuelen:1000
      RX bytes:15134444 (15.1 MB)  TX bytes:2683025 (2.6 MB)

lo    Link encap:Local Loopback
      inet addr:127.0.0.1  Mask:255.0.0.0
      inet6 addr: ::1/128 Scope:Host
      UP LOOPBACK RUNNING  MTU:16436  Metric:1
      RX packets:9944 errors:0 dropped:0 overruns:0 frame:0
      TX packets:9944 errors:0 dropped:0 overruns:0 carrier:0
      collisions:0 txqueuelen:0
      RX bytes:1139347 (1.1 MB)  TX bytes:1139347 (1.1 MB)

I've executed arp -vd 178.32.136.212 to delete the entry in the arp. But after about one our it is listed again.
During the time that the entry was deleted the log was clear.
Why it came back?

share|improve this question
    
can you show ifconfig output from both servers? –  DukeLion Jun 5 '12 at 10:22
    
added ifconfig. –  mcmorry Jun 5 '12 at 10:26
    
I have executed arp -d 178.32.136.212 Now the entry is no more listed, but I have fear that it could come back –  mcmorry Jun 5 '12 at 10:29
    
ARP works fine, as I can see. What exactly is the problem? –  DukeLion Jun 5 '12 at 10:29
    
How did you test it? It could be very useful to know that. Probably it is working correctly because I just deleted the entries? The problem is just that the provider is complaining about a "huge amount of useless traffic" from my IP. this was last entry in the log: Tue Jun 5 12:04:56 2012 : arp who-has 178.32.136.212 tell 178.32.136.224 –  mcmorry Jun 5 '12 at 10:36

2 Answers 2

up vote 1 down vote accepted

"ARP who-has" is a broadcast packet. It is normal for you to receive it, since both of your server's interfaces are in one broadcast domain.

It is possible that your provider expects you to have all virtual servers in routed mode, but you use bridged. In this case broadcast packet is not limited to your virtual interfaces, and floods your physical uplink.

share|improve this answer
    
The provider specs indicates to set the broadcast to the same ip of the virtual machine. Yesterday a system administrator told me that is wrong and that should be .255 Anyway the ARP problem was the same before and after the change. Do you think that the provider specs are fine. Should I set the broadcast to the same IP of the server? –  mcmorry Jun 5 '12 at 10:43
    
broadcast IP is somewhat different. ARP is using ethernet broadcast, not IP. If you are using IP broadcast... well, if you do, you'd have known about that. –  DukeLion Jun 5 '12 at 10:48
    
I'm sure that they want them in bridge mode. This is the link they told me to look at to resolve the problem: help.ovh.co.uk/BridgeClient The problem is that I can't set the mask to 255.255.255.255. The network doesn't start. –  mcmorry Jun 5 '12 at 10:49
    
It's a nice and detailed guide. Did you follow it? You may miss the 'assign a mac to a virtual IP FailOver' part. Netmask and broadcast you are using for virtual servers is wrong. –  DukeLion Jun 5 '12 at 11:52
    
I set broadcast as they want (the same as Failove IP), but I can't assign netmask to 255.255.255.255 and gateway to the .254 of the physical host. When I try I get 'Failed to bring up eth0'. I've seen that arp cache has nothing to do with this. Sorry for that. –  mcmorry Jun 5 '12 at 13:05

Why not just get two Ubuntu VPS's from your ISP? They shouldn't cost much and the networking and virtualization intricacies would be their problem, not yours...

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.