1

Sometimes a botnet (or whatever) tries to port scan pretty much all IPs in the internal network (two /21 subnets) in one second. As a result the router sends out a lot of ARP requests and some slower switches get "clogged" - sometimes ping inside the LAN becomes 4 seconds or packets are lost altogether.

I have read that I could use arpd to cache negative entries (host is offline) and not resend the request each time a packet for that host comes in. However, I could not make it work.

arpd -a 5 -n 60 -R 20 -B 10 -b /var/arpd/arp.db -k eth1

Suppresses all broadcast ARP requests - no matter how long it has been since last check. Without the "eth1" option, the broadcasts continue as before. Setting /proc/sys/net/ipv4/neigh/eth1/app_solicit to 3 does not change anything.

The distribution is CentOS 6.4 with a custom kernel (3.7.10 with ipset and imq support). I have recompiled it to add CONFIG_ARPD.

0

It turns out I needed a new version of arpd. Downloaded, compiled it and now it works as it should.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.