[2.4.2X] "Undeletable" ARP entries?

[2.4.2X] "Undeletable" ARP entries?

[Matthias Andree]

Hi,

I have strange ARP behaviour here, that I can reproduce. Might be a
kernel bug.

SHORT: I can use the "arp" tool to set an ARP entry that the "arp" tool
cannot delete and that hides from "ip"'s view. I know a workaround (at
the very end of the mail).

LONG:

Use either of:

   SuSE 2.4.20 kernel for 8.2 (k_athlon-2.4.20-96)
or 2.4.22-rc2-ac1
   (I haven't tried any other version)

Use this tool:

$ arp -V
net-tools 1.60
arp 1.88 (2001-04-04)
+I18N
AF: (inet) +UNIX +INET +INET6 +IPX +AX25 +NETROM +X25 +ATALK -ECONET -ROSE
HW: (ether) +ETHER +ARC +SLIP +PPP +TUNNEL +TR +AX25 +NETROM +X25 +FR -ROSE -ASH +SIT +FDDI +HIPPI -HDLC/LAPB 

Now type (192.168.4.4 isn't available, I would like to use it as SNAT
source):

$ arp -Ds 192.168.4.4 eth1 pub

This entry cannot be deleted:

$ arp -d 192.168.4.4
SIOCDARP(priv): Network is unreachable
(even if a route for 192.168.4.4 is set, the entry isn't removed)
$ arp -d 192.168.4.4 pub
SIOCDARP(pub): No such file or directory

The interesting part is: The address doesn't show up in netlink, 

$ ip -s neigh show nud all | grep 4.4
$
(no output)

/proc/net/arp excerpt:
IP address       HW type     Flags       HW address            Mask     Device
192.168.4.4      0x1         0xc         00:00:00:00:00:00     *        eth1

This doesn't work either:

$ ip neigh d 192.168.4.4 dev eth1
RTNETLINK answers: Invalid argument
$ ip neigh flush dev eth1
Nothing to flush.

This appears to be a kernel bug, unless I missed documentation on how to
remove such an ARP entry.

WORKAROUND:

$ ip addr add 192.168.4.4 dev eth1
$ ip addr del 192.168.4.4 dev eth1

Now the arp entry is gone, probably as a side effect of taking down
resources related to 192.168.4.4.
HOWEVER: the ARP entry was supposed to be permanent, so it may be
another bug that the entry is gone after removing an IP alias.

Anyone got ideas or patches to try?

-- 
Matthias Andree

Re: [2.4.2X] "Undeletable" ARP entries?

[Matthias Andree]

>    SuSE 2.4.20 kernel for 8.2 (k_athlon-2.4.20-96)
> or 2.4.22-rc2-ac1

...

> WORKAROUND:

This workaround will only work on 2.4.22-rc2-ac1, but not on SuSE's
2.4.20 kernel. -ac bug?

> $ ip addr add 192.168.4.4 dev eth1
> $ ip addr del 192.168.4.4 dev eth1
> 
> Now the arp entry is gone, probably as a side effect of taking down
> resources related to 192.168.4.4.
> HOWEVER: the ARP entry was supposed to be permanent, so it may be
> another bug that the entry is gone after removing an IP alias.
> 
> Anyone got ideas or patches to try?
> 

Re: [2.4.2X] "Undeletable" ARP entries?

[Casey Carter]

Matthias Andree wrote:

>Hi,
>
>I have strange ARP behaviour here, that I can reproduce. Might be a
>kernel bug.
>
>SHORT: I can use the "arp" tool to set an ARP entry that the "arp" tool
>cannot delete and that hides from "ip"'s view. I know a workaround (at
>the very end of the mail).
>
>LONG:
>
>Use either of:
>
>   SuSE 2.4.20 kernel for 8.2 (k_athlon-2.4.20-96)
>or 2.4.22-rc2-ac1
>   (I haven't tried any other version)
>
>Use this tool:
>
>$ arp -V
>net-tools 1.60
>arp 1.88 (2001-04-04)
>+I18N
>AF: (inet) +UNIX +INET +INET6 +IPX +AX25 +NETROM +X25 +ATALK -ECONET -ROSE
>HW: (ether) +ETHER +ARC +SLIP +PPP +TUNNEL +TR +AX25 +NETROM +X25 +FR -ROSE -ASH +SIT +FDDI +HIPPI -HDLC/LAPB 
>
>Now type (192.168.4.4 isn't available, I would like to use it as SNAT
>source):
>
>$ arp -Ds 192.168.4.4 eth1 pub
>
>This entry cannot be deleted:
>
>$ arp -d 192.168.4.4
>SIOCDARP(priv): Network is unreachable
>(even if a route for 192.168.4.4 is set, the entry isn't removed)
>$ arp -d 192.168.4.4 pub
>SIOCDARP(pub): No such file or directory
>
>  
>
Try "arp -i eth1 -d 192.168.4.4 pub"

-- 
Casey Carter
Casey@Carter.net
ccarter@cs.uiuc.edu
AIM: cartec69

Re: [2.4.2X] "Undeletable" ARP entries?

[Matthias Andree]

On Wed, 20 Aug 2003, Casey Carter wrote:

> Try "arp -i eth1 -d 192.168.4.4 pub"

Appears to work (tried on both kernel versions), thank you.

The question why this doesn't show up in "ip neigh" remains though.

Re: [2.4.2X] "Undeletable" ARP entries?

[Bernd Eckenfels]

In article <20030820162530.GF12023@merlin.emma.line.org> you wrote:
> The question why this doesn't show up in "ip neigh" remains though.

You can use "ip neigh add|del proxy <ip> dev <dev>" but ip-route will not
list those entries. 

I am not sure if this is oversight or intention, as  Alexey somewhat prefers
to shift this problem to user mode solutions.

Gruss
Bernd
-- 
eckes privat - http://www.eckes.org/
Project Freefire - http://www.freefire.org/