Re: Routing and ARP Problem - HELP

From: prg (rdgentry1_at_cablelynx.com)
Date: 03/07/05


Date: 7 Mar 2005 10:04:18 -0800


Adem Sen wrote:
> Hello Newsgroup,
>
> I could not find any solution for my problem, and hope to fine it
here.
>
> Some specifications:
> Genttoo Linux (2.6.8.1) running on HP ProLiant DL 360 G4 2x3.0 GHz
> DualCore XEON
> 1 x 2 Port OnBoard Mobo nic (tg3 module)
> 2 x 4 Port Intel Pro 1000 (So we have 10 eth Interfaces - from eth0
to
> eth9)
>
> My Problem was, that eth0 had answered to any ARP Request, which was
> sent to eth1 - eth9 for example. So it answered every arp request for
he
> other Interfaces.

Default Linux behavior.

> I followed these Steps at:

Which steps and which settings did you use?

> http://forums.gentoo.org/viewtopic.php?p=2149737#2149737 and now my
eth0
> interface answers only to ARP Requests, which are explicity for
itself.
>
> But now, the other Interfaces do not function correctly. When I try
to
> ping eth1 for example, I see the ARP Request (tcpdump) on eth1 but
eth1
> does not answer the ARP REQUEST, so no IP connection gets
established.

You will always need to flush arp caches whenever you change settings
that effect arp reply/request changes. This will force new arp
requests. Arping can sometimes be used to "force" new arp cache
entries.

> Can anyone please give me a hint? What is wrong here? Why do my other

> eth Interfaces no more answer to ARP Requests? My eth0 - and only
eth0 -
> still function as it should.

You could have a number of issues here, but hopefully the reworked 2.6
kernel deals with some of them. I don't have ready access to a 2.6
kernel machine so can't say what peculiar problems may lie there.

With arp_filter=1 _and_ with proper route table entries you may get
your needed behavior.

>>From your posting to gentoo:
"The problem is, that our current design will for sure not work this
way since we are in same subnet and i can only set one default gateway
over one nic."

It sounds like your hoping to direct some nics/IPs to use a different
(non-default) gateway. There is no problem with having multiple
gateways. You can (normally) only have a single _default_ gateway. To
use more than one gateway, of course, multiple gateways must be
available on the subnet.

Even with a single gateway, the other nic/IPs will probably need a
distinct route table entry with an explict gateway entry (ie., don't
expect them to simply use the default GW).

If this still does not provide needed behavior, you may have to use
multiple routing tables. It's not clear if this will be _necessary_
for your needs, but it may be needed or well advised _if_ you can get
some cooperation from whoever controls the gateway(s) router(s). Using
the ip tools and policy routing you can effectively run multiple IP
nets on the same physical (ethernet) network.

You may find these useful:
http://ipsysctl-tutorial.frozentux.net/ipsysctl-tutorial.html
http://linux-ip.net/html/
http://linux-ip.net/gl/ip-cref/ < ip tools reference
http://www.policyrouting.org/PolicyRoutingBook/ONLINE/TOC.html

hth,
prg



Relevant Pages

  • Re: Query regarding subnetting
    ... > let the subnet of the host be as follows 255.255.255.192 and gateway ... The router needs to know what IPs to accept from its LAN, ... Whether an IP is sent to a router or directly (arp) depends upon whether ... broadcast address to find other machines and negotiate master browser. ...
    (comp.os.linux.networking)
  • Re: Solution to ARP spoofing on 3560 and 2960 switches please
    ... the buildings have their own VLAN/subnets. ... strange ARP packets and announcing themselves as the gateway of the ... instead of using the real gateway ... Although I haven't confirmed it, I suspect the infected system will send the ARP packets with its own MAC address in the frame, and only alter the "Sender MAC Address" in the ARP header. ...
    (comp.dcom.sys.cisco)
  • Re: Solution to ARP spoofing on 3560 and 2960 switches please
    ... all the infections 7/24. ... the buildings have their own VLAN/subnets. ... strange ARP packets and announcing themselves as the gateway of the ... instead of using the real gateway ...
    (comp.dcom.sys.cisco)
  • Re: A little suspicious about ARP packets
    ... > A small extract of the stream of ARP logs is:- ... Whenever a connection attempt is made from the outside to any node on your ... the gateway MUST broadcast an ARP request to the subnet (except if ... and Nimda probes will cause an abundance of ARP request broadcasts. ...
    (comp.security.firewalls)
  • Re: Solution to ARP spoofing on 3560 and 2960 switches please
    ... the buildings have their own VLAN/subnets. ... strange ARP packets and announcing themselves as the gateway of the ... instead of using the real gateway ... As a solution DHCP spoofing (Dynamic ARP Inspection.) is recommended ...
    (comp.dcom.sys.cisco)