fxp(4) not responding to arp requests (aliases)

[Eduardo Meyer]

On 7/2/07, David DeSimone <fox at verio.net> wrote:
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
>
> Eduardo Meyer <dudu.meyer at gmail.com> wrote:
> >
> > When a host who is talking to be deletes its arp entry which has my IP
> > address, communication goes down, and fxp2 never replies to arp
> > requests.  Completly ignores arp, in fact.
>
> Your premise is that the fxp does not respond to arp request, but your
> example does not show an arp request is being received.

Because in fact, while a down/up cycle didnt happen, no arp traffic
happened on fxp2.

>
> > On host2:
> >
> > # arp -d 200.X.Y.5
>
> I presume that host2 has IP 200.X.Y.6 and host1 has IP 200.X.Y.5, since
> you didn't say.

Correct.

>
> > On host1:
> >
> > # tcpdump -n -v -i fxp2 arp
> > tcpdump: listening on fxp2, link-type EN10MB (Ethernet), capture size 96 bytes
> >
> > And nothing happens.
>
> Is host2 trying to send us traffic?  You did not say.

host2 is pinging host1 in another terminal, so host1 should reply the
icmp echo packets, but is not trying to send it, because it didnt get
the icmp echo request

>
> Presumably if host2 is trying to send traffic to host1, you should see this:
>
>     12:41:43.932590 arp who-has 200.X.Y.5 tell 200.X.Y.6
>     12:41:44.932590 arp who-has 200.X.Y.5 tell 200.X.Y.6
>     12:41:45.932590 arp who-has 200.X.Y.5 tell 200.X.Y.6
>
> In other words you should see a repeated arp request with no reply.  Are
> you suggesting that the interface is simply not receiving broadcasts?

On host1 I see

14:08:21.073605 arp who-has 200.X.Y.6 tell 200.X.Y.5
14:08:21.076006 arp reply 200.X.Y.6 is-at 00:11:d8:52:04:fb

So, asking for arp of host2's IP address.

On host 2 I see some tcpdump traffic like this:

14:09:04.090973 arp who-has 200.X.Y.5 tell 200.X.Y.6

Which never has arp replies.

>
> > On host1 I cycle fxp2 up/down:
> >
> > # ifconfig fxp2 down && ifconfig fxp2 up
> >
> > And on host1 immediately I see:
> >
> > 12:41:08.860484 arp who-has 200.X.Y.6 tell 200.X.Y.5
> > 12:41:08.862898 arp reply 200.X.Y.6 is-at 00:11:d8:52:04:fb
>
> This doesn't look like host1 is suddenly receiving and replying to an
> arp request.  Instead, it is suddenly sending out an arp request for
> another host.  Why would it do that?  I thought host1 was trying to
> receive some traffic, not send.

Host1 is trying to send traffic (ping request) all the time. But still
has the entry on its local arp table. I dont know why it request this
information again after the up/down cicle. Since it is dynamic, I
believe this is what it is supposed to do.

>
> > And on host2 immediately I see
> >
> > 12:41:42.932590 arp who-has 200.X.Y.5 tell 200.X.Y.7
> > 12:41:57.515735 arp reply 200.X.Y.5 is-at 00:50:8b:be:64:a4
>
> This is not even the same arp request/reply, so I am not sure what you
> are pointing out here.  Was host2 supposed to be asking for host1's ARP
> all this time but it never got around to asking until just now?  That
> seems to imply a problem with host2, instead of host1.  Also where did
> this 200.X.Y.7 IP come from?  I thought there were only two hosts here.

Should read 200.X.Y.6 where you see 200.X.Y.7. Mispelled.

>
> Maybe you could present a more complete description of which host is
> attempting to send where, and what both hosts see, at the exact same
> time.

The output from "tcpdump -n -v -i <iface> arp" is mentioned in this
email, at the same time, from both host1 and host2. host1 has ping
permanently running against host2.



-- 
===========
Eduardo Meyer
pessoal: dudu.meyer at gmail.com
profissional: ddm.farmaciap at saude.gov.br