FAQ Search Today's Posts Mark Forums Read
» Video Reviews

» Linux Archive

Linux-archive is a website aiming to archive linux email lists and to make them easily accessible for linux users/developers.


» Sponsor

» Partners

» Sponsor

Go Back   Linux Archive > Debian > Debian User

 
 
LinkBack Thread Tools
 
Old 10-11-2012, 08:33 PM
staticsafe
 
Default arp cache incomplete entries

On 11/10/2012 4:24 PM, Panayiotis Karabassis wrote:

Hi,

I've noticed that, often, after establishing a connection to the local
network, important entries in the ARP cache, such as that of my
nameserver, appear as 'incomplete' and have not an associated hardware
address. Connection to these hosts often fails.

What are the possible reasons why this could happen? And is there any
way to repopulate the ARP cache without reconnecting? How is the ARP
cache populated in the first place?

Unfortunately, I often have to reset my router, and hence LAN
connections, because of problems with my ISP, so this problem appears
frequently.

Thanks,
Panayiotis




Your router usually is the one doing ARP requests (correct me please if
I'm wrong) in the format:


"Who has x.x.x.x? Tell x.x.x.x"
with a response of
"x.x.x.x is $macaddress"

You can check this behaviour with a tool like Wireshark or tcpdump.

Perhaps this issue is caused by your frequent router resets?

--
staticsafe
http://staticsafe.ca


--
To UNSUBSCRIBE, email to debian-user-REQUEST@lists.debian.org
with a subject of "unsubscribe". Trouble? Contact listmaster@lists.debian.org

Archive: 50772D09.9090802@staticsafe.ca">http://lists.debian.org/50772D09.9090802@staticsafe.ca
 
Old 10-12-2012, 12:47 AM
Celejar
 
Default arp cache incomplete entries

On Thu, 11 Oct 2012 16:33:13 -0400
staticsafe <me@staticsafe.ca> wrote:

> On 11/10/2012 4:24 PM, Panayiotis Karabassis wrote:
> > Hi,
> >
> > I've noticed that, often, after establishing a connection to the local
> > network, important entries in the ARP cache, such as that of my
> > nameserver, appear as 'incomplete' and have not an associated hardware
> > address. Connection to these hosts often fails.
> >
> > What are the possible reasons why this could happen? And is there any
> > way to repopulate the ARP cache without reconnecting? How is the ARP
> > cache populated in the first place?
> >
> > Unfortunately, I often have to reset my router, and hence LAN
> > connections, because of problems with my ISP, so this problem appears
> > frequently.
> >
> > Thanks,
> > Panayiotis
> >
> >
>
> Your router usually is the one doing ARP requests (correct me please if
> I'm wrong) in the format:
>
> "Who has x.x.x.x? Tell x.x.x.x"
> with a response of
> "x.x.x.x is $macaddress"

I'm no expert, but my impression is that any machine which is asked to
connect to some other host by IP address will issue such an ARP
request, so if I do 'ping x.x.x.x', and x.x.x.x has not been recently
in contact with my machine, my machine will issue an ARP request.

Celejar


--
To UNSUBSCRIBE, email to debian-user-REQUEST@lists.debian.org
with a subject of "unsubscribe". Trouble? Contact listmaster@lists.debian.org
Archive: 20121011204737.6f243366.celejar@gmail.com">http://lists.debian.org/20121011204737.6f243366.celejar@gmail.com
 
Old 10-12-2012, 01:08 AM
Neal Murphy
 
Default arp cache incomplete entries

On Thursday, October 11, 2012 08:47:37 PM Celejar wrote:
>
> I'm no expert, but my impression is that any machine which is asked to
> connect to some other host by IP address will issue such an ARP
> request, so if I do 'ping x.x.x.x', and x.x.x.x has not been recently
> in contact with my machine, my machine will issue an ARP request.

Recall that all ethernet communication (layer 2) is done using MAC addresses.
Also recall that point-to-point links do not use ARP.

A little more specifically, if the IP->MAC translation entry is not in the
cache, the host will issue the ARP request. If the address is not on the local
LAN, the host will issue an ARP request for the appropriate gateway.


--
To UNSUBSCRIBE, email to debian-user-REQUEST@lists.debian.org
with a subject of "unsubscribe". Trouble? Contact listmaster@lists.debian.org
Archive: 201210112108.31906.neal.p.murphy@alum.wpi.edu">htt p://lists.debian.org/201210112108.31906.neal.p.murphy@alum.wpi.edu
 
Old 10-13-2012, 04:23 AM
Panayiotis Karabassis
 
Default arp cache incomplete entries

On 10/12/2012 04:08 AM, Neal Murphy wrote:
> On Thursday, October 11, 2012 08:47:37 PM Celejar wrote:
>>
>> I'm no expert, but my impression is that any machine which is asked to
>> connect to some other host by IP address will issue such an ARP
>> request, so if I do 'ping x.x.x.x', and x.x.x.x has not been recently
>> in contact with my machine, my machine will issue an ARP request.
>
> Recall that all ethernet communication (layer 2) is done using MAC addresses.
> Also recall that point-to-point links do not use ARP.
>
> A little more specifically, if the IP->MAC translation entry is not in the
> cache, the host will issue the ARP request. If the address is not on the local
> LAN, the host will issue an ARP request for the appropriate gateway.

Thanks to all.

In a pattern that is becoming all too familiar, the problematic machine
sends an ARP request, to which the nameserver replies. But the reply is
never received by the asking machine. So says wireshark.

Could this be a fault NIC, or is the packet lost somewhere else?

Another curious thing is that the problematic machine can lose the MAC
address of the nameserver, even after it has obtained it and put it in
the cache. Possibly, the router has rebooted (or at least reestablished
the ADSL connection) in the meanwhile, which may have caused the LAN
connection to be reset too. Or not.

I'm going for an 11-day trip now. I'll look more into it when I get back.

Thanks,
Panayiotis


--
To UNSUBSCRIBE, email to debian-user-REQUEST@lists.debian.org
with a subject of "unsubscribe". Trouble? Contact listmaster@lists.debian.org
Archive: 5078ECC3.5070909@gmail.com">http://lists.debian.org/5078ECC3.5070909@gmail.com
 
Old 10-13-2012, 04:53 AM
Neal Murphy
 
Default arp cache incomplete entries

On Saturday, October 13, 2012 12:23:31 AM Panayiotis Karabassis wrote:
>
> In a pattern that is becoming all too familiar, the problematic machine
> sends an ARP request, to which the nameserver replies. But the reply is
> never received by the asking machine. So says wireshark.
>
> Could this be a fault NIC, or is the packet lost somewhere else?

It's not unknown. First, verify that the ARP cache is correct (host names/adds
match the MAC addrs) on both hosts; on GNU/linux, use 'arp'. Second, directly
connec the requester to the target (use a crossover cable if neither NIC is
GigE). If the ARP tables are correct and direct connection works, then look in
between them; specifically, look for a bad switch (some switches are known to
corrupt their ARP tables and, thus, no longer function correctly as L2
switches). If direct connection doesn't work (with and without crossover
cable), then start looking at the NICs.

If you cannot directly observe the NICs (with tcpdump or equiv.), then you'll
have to deduce the fault by observing whatever traffic that *does* traverse
the LAN.


--
To UNSUBSCRIBE, email to debian-user-REQUEST@lists.debian.org
with a subject of "unsubscribe". Trouble? Contact listmaster@lists.debian.org
Archive: 201210130053.02343.neal.p.murphy@alum.wpi.edu">htt p://lists.debian.org/201210130053.02343.neal.p.murphy@alum.wpi.edu
 

Thread Tools




All times are GMT. The time now is 05:44 AM.

VBulletin, Copyright ©2000 - 2014, Jelsoft Enterprises Ltd.
Content Relevant URLs by vBSEO ©2007, Crawlability, Inc.
Copyright 2007 - 2008, www.linux-archive.org