Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I'm trying to debug an issue involving a KVM virtual machine instance where the instance doesn't respond to network requests when the source is on another physical machine, which is on the same subnet as the virtual machine instance connected via Linux bridging.

I'm trying to reproduce the issue using "packit" to spoof the ARP requests that don't get responded to. Here is an example of an arp request where I don't see a response back from the virtual machine instance (the packet does not make it from the host to the guest).

I'm arping'ing from c220-1 to c220-2, the virtual machine is on c220-2, eth1 of both machines is bridged to br100 on both machines.

root@c220-1:~# arping -c1 -I br100 10.40.0.5

Here's what the tcpdump looks like on the host that has the virtual machine on it. The ARP request makes it the bridge, but a response doesn't come back.

root@c220-2 # tcpdump -ennvvvXXSs 1514 arp -i br100 -c3 -vvv -XX
tcpdump: listening on br100, link-type EN10MB (Ethernet), capture size 1514 bytes
00:06:34.917863 54:78:1a:86:50:c9 > ff:ff:ff:ff:ff:ff, ethertype ARP (0x0806), length 60: Ethernet (len 6), IPv4 (len 4), Request who-has 10.40.0.5 (ff:ff:ff:ff:ff:ff) tell 10.40.0.1, length 46
    0x0000:  ffff ffff ffff 5478 1a86 50c9 0806 0001  ......Tx..P.....
    0x0010:  0800 0604 0001 5478 1a86 50c9 0a28 0001  ......Tx..P..(..
    0x0020:  ffff ffff ffff 0a28 0005 0000 0000 0000  .......(........
    0x0030:  0000 0000 0000 0000 dac7 07ed            ............

If I try to fake this ARP request on c220-2 to reproduce the problem, I get a response(!), even though I'm trying to simulate the same packet. Here's how I'm trying to use packit to reproduce the same ARP request packet sent by c220-1

root@c220-2:~# packit -t ARP -c1 -i br100 -A 1 -y 10.40.0.5 -Y ff:ff:ff:ff:ff:ff  -x 10.40.0.1  -X 54:78:1a:86:50:c9 -p '0x 00 00 00 00 00 00 00 00 00 00 00 00 00 00 da c7 07 ed' -e 54:78:1a:86:50:c9

When I tcpdump in this case, I see the request and the expected response (!)

root@c220-2 # tcpdump -ennvvvXXSs 1514 arp -i br100 -c3 -vvv -XX
00:06:36.422856 54:78:1a:86:50:c9 > ff:ff:ff:ff:ff:ff, ethertype ARP (0x0806), length 60: Ethernet (len 6), IPv4 (len 4), Request who-has 10.40.0.5 (ff:ff:ff:ff:ff:ff) tell 10.40.0.1, length 46
    0x0000:  ffff ffff ffff 5478 1a86 50c9 0806 0001  ......Tx..P.....
    0x0010:  0800 0604 0001 5478 1a86 50c9 0a28 0001  ......Tx..P..(..
    0x0020:  ffff ffff ffff 0a28 0005 0000 0000 0000  .......(........
    0x0030:  0000 0000 0000 0000 dac7 07ed            ............
00:06:36.423078 fa:16:3e:69:44:36 > 54:78:1a:86:50:c9, ethertype ARP (0x0806), length 42: Ethernet (len 6), IPv4 (len 4), Reply 10.40.0.5 is-at fa:16:3e:69:44:36, length 28
    0x0000:  5478 1a86 50c9 fa16 3e69 4436 0806 0001  Tx..P...>iD6....
    0x0010:  0800 0604 0002 fa16 3e69 4436 0a28 0005  ........>iD6.(..
    0x0020:  5478 1a86 50c9 0a28 0001                 Tx..P..(..

The contents of the request packets looks identical to my eye, and yet when I arping from c220-1, there's nor response, but if I fake that packet using packit on c220-2, there is a response.

What could be the difference between the real ARP packet and the fake one? Is there additional info that isn't showing up in the tcpdump?

share|improve this question
    
Lorin, very interesting issue. The requests appear identical. I'm curious what the conversation looks on the other endpoint. What ARP traffic does 10.40.0.5 see? –  Ryan Apr 8 '13 at 19:25
    
It turns out that 10.40.0.5 sees "vlan 0" added to packets that originate on c220-1, but not when they originate from c220-2! I will shortly post some more details on this, possibly in a different question. –  Lorin Hochstein Apr 8 '13 at 19:53
    
@Ryan see serverfault.com/questions/497391/… –  Lorin Hochstein Apr 8 '13 at 20:07

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.