[ILUG] ARP Insanity!
nickm at go2.ie
Tue Feb 21 15:10:39 GMT 2006
Paul Jakma wrote:
> Ie, it's likely not the switch (the one reset anyway). I'm still
> curious about switches that proxy ARP.
I'm fairly sure it's not.
The next two commands were run in parallel in two different terminals,
but on the same machine:
# tcpdump -eqtnni eth0 arp
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on eth0, link-type EN10MB (Ethernet), capture size 96 bytes
00:11:43:fd:a5:15 > ff:ff:ff:ff:ff:ff, ARP, length 42: arp who-has
10.2.1.230 (ff:ff:ff:ff:ff:ff) tell 10.2.1.22
00:20:ed:79:2f:70 > 00:11:43:fd:a5:15, ARP, length 60: arp reply
10.2.1.230 is-at 00:20:ed:79:2f:70
00:14:22:b0:5e:80 > 00:11:43:fd:a5:15, ARP, length 60: arp reply
10.2.1.230 is-at 00:14:22:b0:5e:80
# arping -b 10.2.1.230
ARPING 10.2.1.230 from 10.2.1.22 eth0
Unicast reply from 10.2.1.230 [00:20:ED:79:2F:70] 0.699ms
Unicast reply from 10.2.1.230 [00:14:22:B0:5E:80] 1.115ms
Sent 1 probes (1 broadcast(s))
Received 2 response(s)
The incorrect response is coming from 00:14:22:b0:5e:80 which
is the old server.
More information about the ILUG