[LARTC] large ARP cache

[LARTC] large ARP cache

[David Koski]

Hello,

When executing arp (on host A below), it lists 36 address pairs for an interface
(eth1).  This doesn't make sense to me.  The interface is NAT'ed though.  There
are only two NICs on my computer and only two computers in my domain:

 to
 isp
 |
 | eth1
+------------+
|host A      |
|(does NAT   |
|for host B) |
+------------+
 | eth0
 |
+-------+
|host B |
+-------+


The list in arp includes google.com!

Regards,
David Koski
david@KosmosIsland.com
_______________________________________________
LARTC mailing list / LARTC@mailman.ds9a.nl
http://mailman.ds9a.nl/mailman/listinfo/lartc HOWTO: http://ds9a.nl/lartc/

Re: [LARTC] large ARP cache

[David Koski]

(Duhh!) The question is, is it normal to have an arp cache with entries that
don't even belong in the network?  If not, what needs to be done to keep them
out?

David

On Sun, 3 Feb 2002 19:07:17 -0800
David Koski <david@kosmosisland.com> wrote:

> Hello,
> 
> When executing arp (on host A below), it lists 36 address pairs for an
interface
> (eth1).  This doesn't make sense to me.  The interface is NAT'ed though. 
There
> are only two NICs on my computer and only two computers in my domain:
> 
>  to
>  isp
>  |
>  | eth1
> +------------+
> |host A      |
> |(does NAT   |
> |for host B) |
> +------------+
>  | eth0
>  |
> +-------+
> |host B |
> +-------+
> 
> 
> The list in arp includes google.com!
> 
> Regards,
> David Koski
> david@KosmosIsland.com
> _______________________________________________
> LARTC mailing list / LARTC@mailman.ds9a.nl
> http://mailman.ds9a.nl/mailman/listinfo/lartc HOWTO: http://ds9a.nl/lartc/
_______________________________________________
LARTC mailing list / LARTC@mailman.ds9a.nl
http://mailman.ds9a.nl/mailman/listinfo/lartc HOWTO: http://ds9a.nl/lartc/

Re: [LARTC] large ARP cache

[bert hubert]

On Sun, Feb 03, 2002 at 07:52:12PM -0800, David Koski wrote:
> (Duhh!) The question is, is it normal to have an arp cache with entries that
> don't even belong in the network?  If not, what needs to be done to keep them
> out?

This happens if you don't have a default gateway and something in the
network is feeding you proxy arps, telling you 'yes, I can reach
google.com'.

Add a default route on A to B and the problem will disappear.

Regards,

bert

-- 
http://www.PowerDNS.com          Versatile DNS Software & Services
http://www.tk                              the dot in .tk
Netherlabs BV / Rent-a-Nerd.nl           - Nerd Available -
Linux Advanced Routing & Traffic Control: http://ds9a.nl/lartc
_______________________________________________
LARTC mailing list / LARTC@mailman.ds9a.nl
http://mailman.ds9a.nl/mailman/listinfo/lartc HOWTO: http://ds9a.nl/lartc/

Re: [LARTC] large ARP cache

[Ard van Breemen]

On Mon, Feb 04, 2002 at 11:02:32AM +0100, bert hubert wrote:
> On Sun, Feb 03, 2002 at 07:52:12PM -0800, David Koski wrote:
> > (Duhh!) The question is, is it normal to have an arp cache with entries that
> > don't even belong in the network?  If not, what needs to be done to keep them
> > out?
> 
> This happens if you don't have a default gateway and something in the
> network is feeding you proxy arps, telling you 'yes, I can reach
> google.com'.
> 
> Add a default route on A to B and the problem will disappear.
Eh, he means: add a default route from your router (A) to your internet
router (which I am missing in your picture).
-- 
<ard@telegraafnet.nl> Telegraaf Elektronische Media  http://wwwijzer.nl
http://leerquoten.monster.org/ http://www.faqs.org/rfcs/rfc1855.html 
Let your government know you value your freedom. Sign the petition:
http://petition.eurolinux.org/
_______________________________________________
LARTC mailing list / LARTC@mailman.ds9a.nl
http://mailman.ds9a.nl/mailman/listinfo/lartc HOWTO: http://ds9a.nl/lartc/

Re: [LARTC] large ARP cache

[David Koski]

On Mon, 4 Feb 2002 11:02:32 +0100
bert hubert <ahu@ds9a.nl> wrote:

> On Sun, Feb 03, 2002 at 07:52:12PM -0800, David Koski wrote:
> > (Duhh!) The question is, is it normal to have an arp cache with entries that
> > don't even belong in the network?  If not, what needs to be done to keep
them
> > out?
> 
> This happens if you don't have a default gateway and something in the
> network is feeding you proxy arps, telling you 'yes, I can reach
> google.com'.
> 
> Add a default route on A to B and the problem will disappear.

I had a default route but no gateway as you said!  Once I did:

route add default gw 1.2.3.4 eth1

The problem went away.  And it makes sense.

Thanks!

David Koski
david@KosmosIsland.com
_______________________________________________
LARTC mailing list / LARTC@mailman.ds9a.nl
http://mailman.ds9a.nl/mailman/listinfo/lartc HOWTO: http://ds9a.nl/lartc/