Hello, all.
When I execute arp -a -n, there are lots of arp caches like below. Surely, I set netmask and Broadcast without problem and routing table also no problem.
System is CentOS release 4.7 i386.
I know how to delete the arp cache, but I don't know why ..
# ifconfig eth0 Link encap:Ethernet HWaddr 00:A0:D1:E7:91:CC inet addr:192.168.195.36 Bcast:192.168.195.63 Mask:255.255.255.192
# route -n 192.168.195.0 0.0.0.0 255.255.255.192 U 0 0 0 eth0 0.0.0.0 192.168.195.36 0.0.0.0 UG 0 0 0 eth0
# arp -a -n
? (120.88.46.10) at 00:23:5E:12:63:FE [ether] on eth0 ? (208.80.195.54) at 00:23:5E:12:63:FE [ether] on eth0 ? (125.122.171.33) at 00:23:5E:12:63:FE [ether] on eth0 ? (211.233.26.29) at 00:23:5E:12:63:FE [ether] on eth0 ? (111.125.201.75) at 00:23:5E:12:63:FE [ether] on eth0 ? (218.24.196.100) at 00:23:5E:12:63:FE [ether] on eth0 ? (60.190.216.31) at 00:23:5E:12:63:FE [ether] on eth0 ? (72.232.223.58) at 00:23:5E:12:63:FE [ether] on eth0 ? (211.39.135.185) at 00:23:5E:12:63:FE [ether] on eth0 ? (203.171.229.153) at 00:23:5E:12:63:FE [ether] on eth0 ? (121.11.81.217) at 00:23:5E:12:63:FE [ether] on eth0 ? (61.110.195.18) at 00:11:43:E0:7D:19 [ether] on eth0 ? (61.164.112.5) at 00:23:5E:12:63:FE [ether] on eth0 ? (218.66.79.152) at 00:23:5E:12:63:FE [ether] on eth0 ? (221.139.48.11) at 00:23:5E:12:63:FE [ether] on eth0 ? (211.233.26.12) at 00:23:5E:12:63:FE [ether] on eth0 ? (211.137.175.2) at 00:23:5E:12:63:FE [ether] on eth0 ? (116.71.174.203) at 00:23:5E:12:63:FE [ether] on eth0 ? (72.18.205.157) at 00:23:5E:12:63:FE [ether] on eth0 ? (211.39.136.4) at 00:23:5E:12:63:FE [ether] on eth0 ? (202.255.47.226) at 00:23:5E:12:63:FE [ether] on eth0 ? (211.211.52.134) at 00:23:5E:12:63:FE [ether] on eth0 ? (218.61.2.197) at 00:23:5E:12:63:FE [ether] on eth0 ? (61.164.151.12) at 00:23:5E:12:63:FE [ether] on eth0
.............
_________________________________________________________________ 메신저 10살 생일도 축하해 주시고,이벤트도 참여하세요~! http://im.msn.co.kr/im/main/mainCoverDetail.asp?BbsCode=bbs01&Seq=2688
MontyRee wrote:
Hello, all.
When I execute arp -a -n, there are lots of arp caches like below. Surely, I set netmask and Broadcast without problem and routing table also no problem.
System is CentOS release 4.7 i386.
I know how to delete the arp cache, but I don't know why ..
run tcpdump on the interface, to see what is happening on it. nate
thus nate spake:
MontyRee wrote:
Hello, all.
When I execute arp -a -n, there are lots of arp caches like below. Surely, I set netmask and Broadcast without problem and routing table also no problem.
System is CentOS release 4.7 i386.
I know how to delete the arp cache, but I don't know why ..
run tcpdump on the interface, to see what is happening on it. nate
Proxy ARP enabled?
Timo
Proxy ARP enabled?
No like below.
net.ipv4.conf.eth0.proxy_arp = 0 net.ipv4.conf.lo.proxy_arp = 0 net.ipv4.conf.default.proxy_arp = 0 net.ipv4.conf.all.proxy_arp = 0
Thanks.
----------------------------------------
Date: Thu, 6 Aug 2009 20:00:54 +0200 From: timo.schoeler@riscworks.net To: centos@centos.org Subject: Re: [CentOS] so many arp caches why?
thus nate spake:
MontyRee wrote:
Hello, all.
When I execute arp -a -n, there are lots of arp caches like below. Surely, I set netmask and Broadcast without problem and routing table also no problem.
System is CentOS release 4.7 i386.
I know how to delete the arp cache, but I don't know why ..
run tcpdump on the interface, to see what is happening on it. nate
Proxy ARP enabled?
Timo _______________________________________________ CentOS mailing list CentOS@centos.org http://lists.centos.org/mailman/listinfo/centos
_________________________________________________________________ 메신저 쓰면서 황당하거나, 재미있었던 경험 있으세요? 애기 나누고 이벤트도 참여하세요! http://im.msn.co.kr/im/main/mainCoverDetail.asp?BbsCode=bbs01&Seq=2688
MontyRee wrote:
Hello, all.
When I execute arp -a -n, there are lots of arp caches like below. Surely, I set netmask and Broadcast without problem and routing table also no problem.
System is CentOS release 4.7 i386.
I know how to delete the arp cache, but I don't know why ..
# ifconfig eth0 Link encap:Ethernet HWaddr 00:A0:D1:E7:91:CC inet addr:192.168.195.36 Bcast:192.168.195.63 Mask:255.255.255.192
# route -n 192.168.195.0 0.0.0.0 255.255.255.192 U 0 0 0 eth0 0.0.0.0 192.168.195.36 0.0.0.0 UG 0 0 0 eth0
# arp -a -n
? (120.88.46.10) at 00:23:5E:12:63:FE [ether] on eth0 ? (208.80.195.54) at 00:23:5E:12:63:FE [ether] on eth0 ? (125.122.171.33) at 00:23:5E:12:63:FE [ether] on eth0 ? (211.233.26.29) at 00:23:5E:12:63:FE [ether] on eth0 ? (111.125.201.75) at 00:23:5E:12:63:FE [ether] on eth0 ? (218.24.196.100) at 00:23:5E:12:63:FE [ether] on eth0 ? (60.190.216.31) at 00:23:5E:12:63:FE [ether] on eth0 ? (72.232.223.58) at 00:23:5E:12:63:FE [ether] on eth0 ? (211.39.135.185) at 00:23:5E:12:63:FE [ether] on eth0 ? (203.171.229.153) at 00:23:5E:12:63:FE [ether] on eth0 ? (121.11.81.217) at 00:23:5E:12:63:FE [ether] on eth0 ? (61.110.195.18) at 00:11:43:E0:7D:19 [ether] on eth0 ? (61.164.112.5) at 00:23:5E:12:63:FE [ether] on eth0 ? (218.66.79.152) at 00:23:5E:12:63:FE [ether] on eth0 ? (221.139.48.11) at 00:23:5E:12:63:FE [ether] on eth0 ? (211.233.26.12) at 00:23:5E:12:63:FE [ether] on eth0 ? (211.137.175.2) at 00:23:5E:12:63:FE [ether] on eth0 ? (116.71.174.203) at 00:23:5E:12:63:FE [ether] on eth0 ? (72.18.205.157) at 00:23:5E:12:63:FE [ether] on eth0 ? (211.39.136.4) at 00:23:5E:12:63:FE [ether] on eth0 ? (202.255.47.226) at 00:23:5E:12:63:FE [ether] on eth0 ? (211.211.52.134) at 00:23:5E:12:63:FE [ether] on eth0 ? (218.61.2.197) at 00:23:5E:12:63:FE [ether] on eth0 ? (61.164.151.12) at 00:23:5E:12:63:FE [ether] on eth0
Some other device on the subnet is doing proxy arp.
Some other device on the subnet is doing proxy arp.
No. there is no other card. and as you see, arp caches from eth0..
? (72.18.205.157) at 00:23:5E:12:63:FE [ether] on eth0
I updated all packages including kernel and rebooted but there was no changes..
----------------------------------------
Date: Thu, 6 Aug 2009 13:58:59 -0500 From: lesmikesell@gmail.com To: centos@centos.org Subject: Re: [CentOS] so many arp caches why?
MontyRee wrote:
Hello, all.
When I execute arp -a -n, there are lots of arp caches like below. Surely, I set netmask and Broadcast without problem and routing table also no problem.
System is CentOS release 4.7 i386.
I know how to delete the arp cache, but I don't know why ..
# ifconfig eth0 Link encap:Ethernet HWaddr 00:A0:D1:E7:91:CC inet addr:192.168.195.36 Bcast:192.168.195.63 Mask:255.255.255.192
# route -n 192.168.195.0 0.0.0.0 255.255.255.192 U 0 0 0 eth0 0.0.0.0 192.168.195.36 0.0.0.0 UG 0 0 0 eth0
# arp -a -n
? (120.88.46.10) at 00:23:5E:12:63:FE [ether] on eth0 ? (208.80.195.54) at 00:23:5E:12:63:FE [ether] on eth0 ? (125.122.171.33) at 00:23:5E:12:63:FE [ether] on eth0 ? (211.233.26.29) at 00:23:5E:12:63:FE [ether] on eth0 ? (111.125.201.75) at 00:23:5E:12:63:FE [ether] on eth0 ? (218.24.196.100) at 00:23:5E:12:63:FE [ether] on eth0 ? (60.190.216.31) at 00:23:5E:12:63:FE [ether] on eth0 ? (72.232.223.58) at 00:23:5E:12:63:FE [ether] on eth0 ? (211.39.135.185) at 00:23:5E:12:63:FE [ether] on eth0 ? (203.171.229.153) at 00:23:5E:12:63:FE [ether] on eth0 ? (121.11.81.217) at 00:23:5E:12:63:FE [ether] on eth0 ? (61.110.195.18) at 00:11:43:E0:7D:19 [ether] on eth0 ? (61.164.112.5) at 00:23:5E:12:63:FE [ether] on eth0 ? (218.66.79.152) at 00:23:5E:12:63:FE [ether] on eth0 ? (221.139.48.11) at 00:23:5E:12:63:FE [ether] on eth0 ? (211.233.26.12) at 00:23:5E:12:63:FE [ether] on eth0 ? (211.137.175.2) at 00:23:5E:12:63:FE [ether] on eth0 ? (116.71.174.203) at 00:23:5E:12:63:FE [ether] on eth0 ? (72.18.205.157) at 00:23:5E:12:63:FE [ether] on eth0 ? (211.39.136.4) at 00:23:5E:12:63:FE [ether] on eth0 ? (202.255.47.226) at 00:23:5E:12:63:FE [ether] on eth0 ? (211.211.52.134) at 00:23:5E:12:63:FE [ether] on eth0 ? (218.61.2.197) at 00:23:5E:12:63:FE [ether] on eth0 ? (61.164.151.12) at 00:23:5E:12:63:FE [ether] on eth0
Some other device on the subnet is doing proxy arp.
-- Les Mikesell lesmikesell@gmail.com
CentOS mailing list CentOS@centos.org http://lists.centos.org/mailman/listinfo/centos
_________________________________________________________________ 매일 매일 기분에 따라 메신저 스킨을 바꿔보세요! http://im.msn.co.kr/im/main/mainCoverDetail.asp?BbsCode=bbs01&Seq=2687
MontyRee wrote:
Some other device on the subnet is doing proxy arp.
No. there is no other card.
Not another card, another network device - the one with 00:23:5E:12:63:FE as it's ethernet MAC address.
and as you see, arp caches from eth0..
? (72.18.205.157) at 00:23:5E:12:63:FE [ether] on eth0
Your eth0 MAC address is: 00:A0:D1:E7:91:CC from the ifconfig output you posted. Look though the rest of the arp list to find the IP address in the 192.168.195.xx range with the 00:23:5E:12:63:FE MAC to see which device is sending the arps.
Thanks for your answer.
Not another card, another network device - the one with 00:23:5E:12:63:FE as it's ethernet MAC address.
There is no another network device as I know. Can I check by some command except ifconfig or ip?
# ip link show 1: lo: mtu 16436 qdisc noqueue link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00 2: eth0: mtu 1500 qdisc pfifo_fast qlen 1000 link/ether 00:a0:d1:e7:91:cc brd ff:ff:ff:ff:ff:ff 3: eth1: mtu 1500 qdisc noop qlen 1000 link/ether 00:a0:d1:e7:91:cd brd ff:ff:ff:ff:ff:ff 4: sit0: mtu 1480 qdisc noop link/sit 0.0.0.0 brd 0.0.0.0
Your eth0 MAC address is: 00:A0:D1:E7:91:CC from the ifconfig output you posted. Look though the rest of the arp list to find the IP address in the 192.168.195.xx range with the 00:23:5E:12:63:FE MAC to see which device is sending the arps.
00:23:5E:12:63:FE is a cisco vendor device and gateway mac address. Is it a bug of the NIC or OS?
Thanks.
_________________________________________________________________ 메신저 친구가 갑자기 돈을 빌려달라고 하면 전화 확인은 필수입니다. 주의하세요! http://im.msn.co.kr/im/main/mainFaqDetail.asp?seq=96&page=1&BbsCode=...
MontyRee wrote:
Thanks for your answer.
Not another card, another network device - the one with 00:23:5E:12:63:FE as it's ethernet MAC address.
There is no another network device as I know. Can I check by some command except ifconfig or ip?
You must have at least one other thing on the network - like your router.
# ip link show 1: lo: mtu 16436 qdisc noqueue link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00 2: eth0: mtu 1500 qdisc pfifo_fast qlen 1000 link/ether 00:a0:d1:e7:91:cc brd ff:ff:ff:ff:ff:ff 3: eth1: mtu 1500 qdisc noop qlen 1000 link/ether 00:a0:d1:e7:91:cd brd ff:ff:ff:ff:ff:ff 4: sit0: mtu 1480 qdisc noop link/sit 0.0.0.0 brd 0.0.0.0
It is some other box.
Your eth0 MAC address is: 00:A0:D1:E7:91:CC from the ifconfig output you posted. Look though the rest of the arp list to find the IP address in the 192.168.195.xx range with the 00:23:5E:12:63:FE MAC to see which device is sending the arps.
00:23:5E:12:63:FE is a cisco vendor device and gateway mac address. Is it a bug of the NIC or OS?
The OS just stores arp responses something else sends it. That's normal. What is odd is that some device on the connected ethernet is sending arp responses for IP address that don't belong to the same subnet. That means it is configured to proxy-arp. Long ago people would sometimes configure routers to proxy-arp and not set default routes on other equipment but I haven't heard of a setup like that in years. You might try running wireshark to see if the linux box is sending arp queries (it shouldn't except for addreses within the netmask) or if it just collecting broadcasts.
MontyRee wrote:
# ifconfig eth0 Link encap:Ethernet HWaddr 00:A0:D1:E7:91:CC inet addr:192.168.195.36 Bcast:192.168.195.63 Mask:255.255.255.192 # route -n 192.168.195.0 0.0.0.0 255.255.255.192 U 0 0 0 eth0 0.0.0.0 192.168.195.36 0.0.0.0 UG 0 0 0 eth0
your default gateway is not set correctly.
the ip address of your nic is set as your default gateway. the default gateway ip address should be your router/modem/whatever.
your internet access is working because your gateway is smarter than you are.
to the file /etc/sysconfig/network add the line: GATEWAY=192.168.195.xx where 192.168.195.xx is the ip address of your gateway. then: service network restart