Questions tagged [arp]
Address Resolution Protocol is a layer 2 networking protocol used for resolving layer 3 addresses (such as IP addresses) into layer 2 addresses (such as Ethernet MACs). It is used by network devices when communicating with devices on the same layer 2 network.
424
questions
1
vote
2
answers
540
views
How is a TCP request routed from a virtual machine to an outside resource and back again?
Scenario: Computer A has a local ip of 192.168.1.100, which is running a VM inside of it. The VM now makes a tcp request to an external IP address (74.125.225.98).
Could someone explain how the ...
0
votes
1
answer
7k
views
Cisco ASA 5510 needs "clear arp <Interface>" periodically to reach a single host
ASA 9.0(3)
The symptom is that I can ping from the ASA to any other host in that interface's subnet, save one particular host (that host can ping the interface on the ASA however). If I do "clear arp ...
0
votes
1
answer
456
views
iptables: service per physical interface
I have a vm on which I'm trying to configure (unsuccessfully) one service per physical device - i.e. ssh open only on eth0, http only on eth1 and ftp only on eth2. This has to happen regardless on the ...
-3
votes
1
answer
3k
views
How does Bind IP to MAC work? [closed]
A client is connected to the network with a DHCP server, but also has a Bind IP to MAC entry in the router. What is the sequence of steps that determine the final client IP configuration given that (1)...
0
votes
2
answers
13k
views
Why am I not getting an ARP reply with this request?
Using pcap_sendpacket in C, I'm manually sending the following packet on wlan0 (I've left out some fields, but I think they are correct):
(Ethernet layer)
eth src: <wlan0 MAC address>
eth dest:...
1
vote
0
answers
876
views
Broadcom NICs, Cisco ASA and ARP request collisions
First of all I am sorry for my english mistakes.
Help me please to solve the problem with ARP request collision incidents.
I have IBM BladeCenter E chasis with blade servers are installed in this ...
1
vote
2
answers
3k
views
External ip address being treated as local (ARP asking for external IP's address)
I am using a virtual machine with OpenWRT for routing, on a Linux machine (Slackware). I am trying to configure a host only interface (eth0) as the wan interface. eth1 is Ethernet attached as a bridge ...
0
votes
1
answer
397
views
How can I tell what's happening to my packets?
I'm trying to bring up a little box on my network. I just reflashed the firmware and it's supposed to come up as 192.168.1.1 by default. My router is a DSL modem at 192.168.0.1; it usually uses a ...
0
votes
0
answers
3k
views
VMWare use of Gratuitous ARP REPLY
I have an ESXi cluster that hosts several Windows Server VMs and around 30 Windows workstation VMs. Packet captures show a high number of ARP replies of the form:
-sender_ip: VM IP
-sender_mac: VM ...
1
vote
2
answers
2k
views
Windows 8 is not always selecting correct network card for my outgoing transmissions
The company I work for builds and sells industrial machines. One of our products is a machine which is controlled by a PC running Windows. This particular machine uses a networked device with ...
1
vote
1
answer
1k
views
Directed ARP requests do not arrive at bridge interface
I'm baffled by the following weird bridge/arp behavior under Linux. It somehow seems to filter directed ARP requests, whereas it should forward them to the other end of the bridge. To test, I run the ...
0
votes
0
answers
75
views
SYN-ACK with identical MACs
What could cause a CentOS machine to respond with SYN-ACK packet having both source and destination MACs set to the address of the NIC from which the packet is being sent?
0
votes
1
answer
517
views
Group Policy for Time Sync = ARP Flood?
I have a Windows Server 2008 R2 domain controller and a bunch of workstations of various versions of Windows - XP SP3, Vista, 7, 8.1. Time sync wasn't working correctly on a few PCs so I followed the ...
1
vote
1
answer
3k
views
arp problems with transparent bridge on linux
I've been trying to secure my virtual machines on my esx server by putting them behind a transparent bridge with 2 interfaces, one in front, one at the back.
My intention is to put all the firewall ...
0
votes
2
answers
776
views
Must an ARP broadcast query packet contain the target node's MAC address [closed]
So far as I know, Address Resolution Protocol (ARP), translates the IP address of a computer on a local network to an equivalent layer 2 address (MAC address), such as sending a packet from machine A ...
2
votes
1
answer
940
views
Determine the hostnames of IP conflict
I have a network with several hundred machines on it. I have a machine that gives intermittent connectivity issues, reported via vSphere web client. This troublesome machine has the hostname "...
0
votes
3
answers
735
views
Linux (Ubuntu 12.04) sending ARP requests over single interface
I have a system with custom hardware hooked up to 2 different ethernet ports on the same system. The interfaces are configured on the same subnet because the hardware (FPGA-based) has a hardcoded IP ...
0
votes
0
answers
767
views
localhost answering wrong ip
No idea how/why, but here's what I'm seeing. Consider 3 CentOS 5.10 boxes:
Host A [10.1.2.7]
Host B [10.1.2.8]
Host C [10.1.2.9]
All of a sudden we're getting strange behavior from Host X, 10.1.2....
-2
votes
3
answers
176
views
Prevent Linux server host from using ARP
If I know all client will connect to the sever with the same MAC address and to the same interface, is it possible to prevent from server host to send ARP request for each new client IP it gets a ...
4
votes
1
answer
709
views
VMXNET3 nic loses the ability to update ARP table after N hours
I have a fedora 18 VM that stops updating the arp table on eth1 after running for a number of hours to days. There are other VMs on the same hypervisor that can access all of the same networks without ...
1
vote
1
answer
2k
views
"Destination Host Unreachable" and ARP returns no addresses over LAN
I am currently trying to setup LAN over two machines with a network mask of 255.255.255.0 however I am receiving the following message when trying to communicate between them both;
[root@alpha ~]# ...
5
votes
4
answers
7k
views
network level of veth doesn't respond to arp
I decided to play with veth : create a veth pair and
send a ping from one end to another.
$ ip link add type veth
$ ip addr add 192.168.99.1 dev veth4
$ ip addr add 192.168.99.2 dev veth5
$ ip link ...
1
vote
3
answers
5k
views
Switch behavior on unicast packets when the destination is unknown
Please let me start by saying I am no network expert, I am a programmer who does a fair amount of L3/4 programming.
My question is that when a switch receives a packet with a destination MAC that is ...
-2
votes
4
answers
208
views
Find out IP of connected interface?
Suppose I connect two machines directly together with an ethernet cable. I know nothing about machine2's configuration - I only have access to machine1.
What can I do on machine1 to determine ...
4
votes
2
answers
4k
views
ARP responds with single MAC address on Linux server with multiple interfaces on the same network
Linux server has 2 active network interfaces:
IF:eth1 IP:192.168.1.1/24 MAC:11:11:11:11:11:11 (1GbE)
IF:eth2 IP:192.168.1.2/24 MAC:22:22:22:22:22:22 (10GbE)
The idea is that the ...
0
votes
1
answer
212
views
Can Windows Populate Network List in an MPLS?
With an MPLS of one host and one remote, when I go to Windows Explorer and bring up "Network", is the list supposed to be populated with the devices on both subnets?
If not, can it be made to do so?
...
0
votes
1
answer
5k
views
brctl bridge forwarding packets to promiscuous interfaces
I have two promiscuous sniffing interfaces on my linux box:
eth0 is connected to an external vlan bridge
eth1 is connected to an internal vlan bridge
with eth0 I can sniff all traffic on my "...
1
vote
0
answers
795
views
Duplicate entries in switch ARP table
A server is showing twice or more on my L2 switch ARP table
Same IP address, mac address, and ethernet port.
What could be causing this?
Thanks
4
votes
1
answer
3k
views
nmap and arp-scan inconsistent IP-MAC results
I seem to get variable and inconsistent results for the IP/MAC addresses from a particular machine, using nmap or arp-scan.
The machine has 3 interfaces, and this is what it shows:
$ uname -a
Linux ...
0
votes
1
answer
216
views
what would happen when macchanger to gateway mac address? [closed]
I thought arpspoof GATEWAY_IP -t VICTIM_IP can be prevented by add a static arp entry on victim side, i.e. arp -s GATEWAY_IP GATEWAY_MAC
I read https://superuser.com/questions/17696/what-happens-when-...
1
vote
2
answers
705
views
Is Windows Server 2008 R2 arp cache per user or per machine?
When running arp -a in a Windows Server 2008 R2 prompt, will the returned entries cover connections from all users logged on to the machine or only the current?
2
votes
1
answer
2k
views
How to convert proxy ARP setup to IPv6?
My company has a router/firewall deployed with the "common" Proxy ARP setup: it sits between some servers and the ISP gateway, and intercepts all the packets with proxy arp, so that it can apply both ...
0
votes
0
answers
415
views
Ubuntu 12.04 reply ARP request delay 10+ seconds
I'm running Ubuntu 12.04 in VirtualBox, my server program is running in it, its IP is 192.168.1.105.
My client is running at 192.168.1.107. But the client alway took 10+ seconds to send a package to ...
2
votes
1
answer
9k
views
Networking ARP table in windows cmd
I am reading the book practical packet analysis and I have just learned the fundamentals of the ARP protocol. They also added something about the arp -a cmd command. I'm curious about some of the ...
2
votes
2
answers
4k
views
Windows Domain controller ARPing for 169.254.0.0/16 addresses
I've been doing some sniffing on my company's network to try to clean up some of traffic and have noticed that one of our Server 2008 Domain Controllers is sending out ARP's every second or two to ...
1
vote
2
answers
16k
views
Physical switch not learning MAC address of virtual machines
I have a virtual environment running vSphere 5.1. I have two ESXis with a vDS between them. There is, for the purposes of the discussion, just one portgroup on that vDS configured to use a VLAN. The ...
1
vote
1
answer
822
views
arpd does not send ARP requests
Sometimes a botnet (or whatever) tries to port scan pretty much all IPs in the internal network (two /21 subnets) in one second. As a result the router sends out a lot of ARP requests and some slower ...
1
vote
1
answer
297
views
iptables arp compare and execute
EXAMPLE:
iptables
:internet - [0:0]
-A internet -m mac --mac-source 48:5D:60:FC:29:B0 -j RETURN
COMMIT
[root@localhost:~ ] $ arp
Address HWtype HWaddress Flags Mask ...
1
vote
1
answer
152
views
Understanding ARP traces during OS load
Consider the following ARP packets captured while a unix machine was booting.
From the packets I understand that this machine whose MAC address is 00:22:22:22:22:22 is requesting information about ...
2
votes
0
answers
790
views
Keepalived failover not working for Static NAT target behind Cisco ASA
I've got a Cisco ASA[0] with a pair of Linux boxes in the DMZ running Keepalived and HAproxy acting as a load-balancing failover pair for another pair of Windows servers, also in the DMZ. I'm ...
1
vote
1
answer
344
views
Move IP from one server to another without disruption
I have an internal DNS server running on a VM. I've rebuilt the server from scratch in a new VM, and I want to cut over from the old to the new at some point. In order to do this, I'll need to take ...
2
votes
0
answers
544
views
I am not able to connect to my server from my leased line internet connection
I am having some troubles connecting to my Fedora server from my static IP ISP connection. Usually I can ping that server with no problems. But other times it just gives me timeout responses. When ...
3
votes
3
answers
9k
views
ARP response is not present on the other port of linux bridge based on ubuntu 13.10
I recently build linux based bridge for packet monitoring purpose, but there is BIG problem.
the environment is,
overall env.
target of monitoring is VMs on vSphere.
two vSwitches are configured on ...
2
votes
2
answers
5k
views
Multiple NIC arp issue
I'm troubleshooting an issue on Centos 6.4. I have a few systems setting up for greenplum. Each one has two "interconnect" interfaces connecting to an isolated subnet. It is like a cluster ...
6
votes
1
answer
6k
views
Linux arp cache timeout values
I'm trying to configure sane values for the Linux kernel arp cache timeout, but I can't find a detailed explanation as to how they work anywhere. Even the kernel.org documentation doesn't give a good ...
20
votes
5
answers
76k
views
ARP broadcast flooding network and high cpu usage
Hoping someone here might have some insight to the issue we are facing. Currently we have Cisco TAC looking at the case but they are struggling to find the root cause.
Although the title mentions ARP ...
2
votes
0
answers
405
views
Solaris 10 invalid ARP requests from 0.0.0.0? Link up/down every hour or 2
The guys at the data center where I'm hosting a server running Solaris 10 are telling me that my server is making a lot of invalid arp requests. This is an example of a portion of what was sent to me ...
2
votes
2
answers
5k
views
How to capture arp table when using network bridging?
I have a computer with 2 NICS that are bridged and I need a means of distinguishing between machines connected to eth0 from machines connected to eth1.
I was hoping to use something like the "arp -a" ...
-5
votes
2
answers
3k
views
Can a computer route IP trafic between two LAN if it is not configured as gateway? [closed]
Having two LAN, each one have its own gateway, DHCP and internet connexion
LAN 1 - IPs: 192.168.0.0-255, Mask: 255.255.254.0, Gateway: 192.168.0.1
LAN 2 - IPs: 192.168.1.1-255, Mask: 255.255.254.0, ...
1
vote
1
answer
655
views
Host not showing in ARP even after broadcast
serverfault community.
What I would like: to determine the current IP of a host (a networked camera to be specific)
What I have: its MAC, its previously documented hostname and IP
What I have done:...