Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I'm trying to diagnose some connection issues I was having last night while setting up my new PC based router.

For a while everything was working perfectly, but then suddenly I found that I couldn't ping the new PC, and I couldn't ping other machines from that PC. Eventually I set wireshark up collecting on my machine and pinged that machine from the new PC. I saw the ping requests reach my machine and the response sent, but I still saw nothing on the new PC. (which is running an embedded version of pfSense - a FreeBSD distribution)

Thinking back the only possibility I can see is that it's something to do with the fact I kept on giving the new PC the same IP address as our existing router, (192.168.1.1) and assigning the old router another IP address (192.168.1.42). I ended up doing this a couple of times and never restarted my main PC, so I wondered if the ARP tables got messed up somehow.

So, what happens to packets where the IP address matches, but the MAC address does not (or the other way around)? Are they just ignored?

Also, are there any more diagnosis tools or methods I can use? (other than just turning different things on and off again...)

share|improve this question
1  
Try arping (google it), also, you can modify ARP tables, have you tried correcting them? –  Karolis T. Sep 11 '09 at 10:22

1 Answer 1

up vote 2 down vote accepted

What you describe indicates that:

  • The router knows where to address your PC on the L2 network in order to send the ping request -- so its ARP cache is presumed to be correct.
  • But your PC doesn't know where to address the router in order to send the ping response -- so its ARP cache might not be correct.

The first two really obvious things to rule out are that:

  1. Your old router isn't still attempting to bring up the IP address 192.168.1.1
  2. Your new router isn't firewalling the ping request (ICMP echo) when it comes in.

Assuming that it isn't these two things then you can proceed in checking that the ARP entries are correct. Bear in mind that unless you are using static ARP entries, which I assume that you aren't, then they are stored dynamically as required and will expire after a period of time. This means that they won't persist across reboots or long periods of time. So if your old router definitely isn't on the old IP address any more then it shouldn't be the cause of the problem.

  1. Make a note of what the correct MAC addresses for your PC and new router are. You can obtain this information from ifconfig or ipconfig, OS dependent.
  2. Double check this against the ARP entries on each device. You can view the current entries in the ARP cache with arp -a or arp -an to skip name resolution.
  3. If the ARP cache from one machine isn't consistent with the MAC address of the other and vice versa then try deleting it with arp -d <ip>. If it comes back with the same address then perhaps you do have a rogue machine on the network.

Incidentally you can also make sure that the MAC addresses displayed in the request and response of the Wireshark capture match those which you have recorded from the machine's interfaces.

share|improve this answer
    
Thanks, that was exactly the answer I was looking for and I learnt something, but unfortunately it didnt solve my problem - all of the ARP tables seemed to be correct. In the end I re-ran the pfSense configuration and it sorted itself out. I suppose it might have been a bug... –  Justin Sep 11 '09 at 17:37

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.