[CentOS] Neighbour table overflow

Fri Nov 28 17:28:19 UTC 2008
Robert Moskowitz <rgm at htt-consult.com>


tdukes at sc.rr.com wrote:
> ---- Robert Moskowitz <rgm at htt-consult.com> wrote: 
>   
>> Thomas Dukes wrote:
>>     
>>>  
>>>
>>> *From:* centos-bounces at centos.org [mailto:centos-bounces at centos.org] 
>>> *On Behalf Of *chloe K
>>> *Sent:* Thursday, November 27, 2008 9:10 PM
>>> *To:* CentOS mailing list
>>> *Subject:* Re: [CentOS] Neighbour table overflow
>>>
>>> what is your netmask?  
>>>  
>>> eth0 = 255.255.240.0
>>>       
>> Why do you have such a large subnet?  There are a number of potential 
>> performance problems with such a setup.  I typically only see this in 
>> large, bridged wireless campuses.  Little justification for it in a 
>> wired network.  (I do have lots of networking experience and knowledge, 
>> having consulted with a number of large deployments).
>>
>> Even with a large subnet, you should not be arping everywhere.  Either 
>> two things are happening:
>>
>> Your system is recording every ARP request it sees ('Who has IP 
>> x.x.x.x') to avoid arping later.  Bad behaviour (IMNSHO), given your 
>> network.
>>
>> Your system is ARPing for every IP address in the subnet to learn all of 
>> its neighbors.  WHy would it do that?  Unless you have some snooping 
>> software running on your system.
>>
>>     
> Hi Robert,
>
> I did not set this value.  Something did but not me.
>
> I am on a roadrunner connection with a dynamic ip.  What do you suggest I change it to?

If you restart your network services (Does RR use PPPoE?) you should 
then have an empty ARP table.

How long does it take to overflow? Can you run TCPDUMP and see if you 
are sending out the ARPs or your system is just building its table based 
on heard ARP requests?