Re: arp tell 0.0.0.0

Chuck Hemker (n2por@amsat.org)
Fri, 17 Dec 1999 23:37:31 -0500 (EST)


I saw this in RFC2131:

The client SHOULD perform a
check on the suggested address to ensure that the address is not
already in use. For example, if the client is on a network that
supports ARP, the client may issue an ARP request for the suggested
request. When broadcasting an ARP request for the suggested address,
the client must fill in its own hardware address as the sender's
hardware address, and 0 as the sender's IP address, to avoid
confusing ARP caches in other hosts on the same subnet.

But I don't believe that was it. It looked more like it thought that interface
was the default route, but it didn't know who to send the packet to. So it was
sending out arp packets requesting addresses for things all over the internet.

Just to explain the background (if it helps):

The first time I saw this, I had my usual bunch of things talking to the
internet (fetchmail, netscape, ...) and my ISP decided to renumber the subnet
that I'm on. To do this, it looks like they reconfigured the router to the new
subnet (so my machine started arp'ing the old router address, but it didn't
respond). I still had a DHCP lease for another 18 hours or so, but I finally
gave up and restarted pump to see if I could get a lease in the new subnet
address range. While pump was trying to get a new address was when I noticed
the problem. I tried a "route del -net default eth0" but soon as I restarted
pump the problem reappeared. About an hour later they finally reconfigured the
DHCP server to give out addresses in the new subnet and then my machine was
happy.

The second time I saw this was when I was doing some hardware changes to my
machine and it decided to switch which ethernet card was which. This caused it
to start sending out DHCP requests on my internal net (which doesn't have a
DHCP server) and I saw some more of these. (not as many because I didn't have
all my usual stuff running yet, but a few of them)

On 17-Dec-99 Florian Heinz wrote:
> Hello,
>
>> My ISP was playing with their DHCP server and while pump was trying to get
>> an
>> address I was doing a tcpdump and noticed a bunch of arp requests going out
>> saying looking for x.x.x.x tell 0.0.0.0. I believe this was because there
>> was
>> a default route pointing to the interface but the interface didn't have an
>> IP
>> address yet. I was just wondering if that might just confuse the other end
>> if
>> someone tried to reply.
>
> I think this is the duplicate address detection as mentioned in
> RFC2131... but don't count on it ;)
>
> Florian Heinz
> -
-
To unsubscribe from this list: send the line "unsubscribe linux-net" in
the body of a message to majordomo@vger.rutgers.edu