Default route changes unexpectedly #2 (was Re: kernel: arpresolve: can't allocate llinfo for 65.59.233.102)

[Nick Rogers]

On Thu, Mar 7, 2013 at 12:51 PM, Li, Qing <qing.li at bluecoat.com> wrote:
> Hi,
>
>>
>> I can confirm I get these messages as well:
>>
>> Mar  7 19:40:25 opole kernel: arpresolve: can't allocate llinfo for
>> 86.58.122.125
>> Mar  7 19:40:25 opole kernel: arpresolve: can't allocate llinfo for
>> 86.58.122.125
>>
>> IP 86.58.122.125 is not from IP pool used by me.
>>
>
> This kernel message is a merely a side effect of a bad route (with
> off-net IP address) being injected as a default route replacement.

I would normally agree, however in the last case, the arpresolve
messages started happening about two hours before the default route
was changed to the IP in the arpresolve message. At least, thats when
my script that runs every second detected a change in the route. The
script parses netstat -rn output to determine if the default route is
correct or not. There was not a 2 hour downtime.

Heres the logging of my script followed by appropriate /var/log/messages.

2013/03/05 21:13:02 rxgd[10816] DEBUG> Rxg::Route::parseRoutes -
/usr/bin/netstat -rnlW -f inet
2013/03/05 21:13:02 rxgd[10816] DEBUG> Rxg::Route::parseRoutes - done
parsing routes
2013/03/05 21:13:02 rxgd[10816] INFO> Rxg::Route::checkDefaultRoute -
deleting incorrect default route em0/50.142.201.101

Mar  5 19:12:48 westmar kernel: arpresolve: can't allocate llinfo for
50.142.201.101
Mar  5 19:12:48 westmar last message repeated 107 times
Mar  5 21:12:48 westmar named[10906]: internal_send: 66.187.177.13#53:
Invalid argument
Mar  5 19:12:48 westmar kernel: arpresolve: can't allocate llinfo for
50.142.201.101
Mar  5 19:12:48 westmar last message repeated 24 times

I don't understand the timestamps however. It is peculiar to have an
arpresolve message at 19:12 followed by bind logging from 21:12, then
another arpresolve at 19:12. Maybe it is just because of losing the
default route.

>
> --Qing
>
>