[ILUG] ARP Insanity!

[Nick Murtagh]

Paul Jakma wrote:
> Ie, it's likely not the switch (the one reset anyway). I'm still 
> curious about switches that proxy ARP.

I'm fairly sure it's not.


The next two commands were run in parallel in two different terminals,
but on the same machine:

# tcpdump -eqtnni eth0 arp
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on eth0, link-type EN10MB (Ethernet), capture size 96 bytes
00:11:43:fd:a5:15 > ff:ff:ff:ff:ff:ff, ARP, length 42: arp who-has 
10.2.1.230 (ff:ff:ff:ff:ff:ff) tell 10.2.1.22
00:20:ed:79:2f:70 > 00:11:43:fd:a5:15, ARP, length 60: arp reply 
10.2.1.230 is-at 00:20:ed:79:2f:70
00:14:22:b0:5e:80 > 00:11:43:fd:a5:15, ARP, length 60: arp reply 
10.2.1.230 is-at 00:14:22:b0:5e:80
#

# arping -b 10.2.1.230
ARPING 10.2.1.230 from 10.2.1.22 eth0
Unicast reply from 10.2.1.230 [00:20:ED:79:2F:70]  0.699ms
Unicast reply from 10.2.1.230 [00:14:22:B0:5E:80]  1.115ms
Sent 1 probes (1 broadcast(s))
Received 2 response(s)
#


The incorrect response is coming from 00:14:22:b0:5e:80 which
is the old server.

Madness!