Network trivia

Richard B. Johnson (
Wed, 5 Mar 1997 18:47:52 -0500 (EST)

Linux chaos 2.1.28 #5 Wed Mar 5 14:20:09 EST 1997 i586

It looks as though EVERYONE on my local segment of the ethernet leg
is now in my ARP cache. I seem to be receiving everyone's packets!

Routing is turned ON during compile, but not enabled. My ethernet sniffer
does not show any duplication of packets, so I am sure that the machine
is not routing anything.

This is the formatted contents of my ARP cache. IP HW 08:00:20:7A:F5:58 IP HW 08:00:20:79:7C:C6 IP HW 08:00:20:79:87:40 IP HW 00:00:0C:0A:3E:D3 IP HW 08:00:20:1D:34:2C IP HW 08:00:20:04:D7:B9 IP HW 08:00:00:85:63:33 IP HW 08:00:20:1F:E1:73 IP HW 02:60:8C:AE:83:83 IP HW 08:00:20:7A:E9:C9 IP HW 00:A0:24:D0:69:40 IP HW 08:00:20:04:DA:43 IP HW 08:00:20:1B:02:5F IP HW 08:00:20:76:D7:9E IP HW 00:A0:24:24:38:5A IP HW 08:00:20:75:84:8F IP HW 08:00:20:20:82:9A IP HW 08:00:20:78:9E:8D IP HW 08:00:00:30:91:73 IP HW 08:00:20:76:FA:5A IP HW 08:00:20:75:A3:A4 IP HW 08:00:20:73:5F:4B IP HW 08:00:20:04:B7:A1 IP HW 00:A0:24:3C:C5:2E

I don't think that this is good. Device eth0 does not report that it is
in promiscuous mode.

Output from `ifconfig` shows nothing wrong except for the missed field
which accounts for TX packets really being the error-count. Note the
number of packets I have received in about 10 minutes of uptime! I
think I am getting them all, then dumping them on the floor. The only
machine that is "broadcasting" its data is which
runs NetBois (MicroStuff puts NETBIOS in Broadcast packets).

I really should not be receiving anything but packets transmitted to my
hardware address plus broadcast! The hardware is supposed to filter, not
the network software.

lo Link encap:Local Loopback
inet addr: Bcast: Mask:
RX packets:0 errors:97 dropped:0 overruns:0
TX packets:0 errors:0 dropped:97 overruns:0

eth0 Link encap:10Mbps Ethernet HWaddr 08:00:00:12:35:99
inet addr: Bcast: Mask:
RX packets:5058913 errors:32629 dropped:0 overruns:0
TX packets:0 errors:233544 dropped:2603 overruns:0
Interrupt:5 Base address:0x300

The output from `route` looks normal, except that "lo" doesn't show
anymore. This hasn't shown for the past few releases. This is probably
just a compatibility problem with my version of `route`.

Kernel routing table
Destination Gateway Genmask Flags MSS Window Use Iface
localnet * U 1500 0 0 eth0
default cisco.analogic. * UG 1500 0 0 eth0

I fear that the ethernet controller is now programmed to receive with
no mask, and sorting through the received junk is now being done in the
kernel. If true, I sure hope it isn't by design! Throwing away 20,000
packets per second in the kernel is sure not going to help performance!

Dick Johnson
Richard B. Johnson
Project Engineer
Analogic Corporation
Voice : (508) 977-3000 ext. 3754
Fax : (508) 532-6097
Modem : (508) 977-6870
Ftp :
Email :,
Penguin : Linux version 2.1.28 on an i586 machine (66.15 BogoMips).
Warning : It's hard to remain at the trailing edge of technology.