ipv4 arp and linux

ipv4 arp and linux

[Tim Warnock]

What arp packet size does a linux 2.4 series kernel use? How would it be
made bigger?

I'm having a problem where a cisco switch is ignoring me because (according
to the guys who operate it) the arp spec for 802.3 is 64 bytes and im not
doing that.

Im not subscribed to the list, so if I could be cc'd I'd appreciate it.

Hope someone can help me, and thanks for taking the time to read this.

Tim

Re: ipv4 arp and linux

[Neil Horman]

Tim Warnock wrote:
> What arp packet size does a linux 2.4 series kernel use? How would it be
> made bigger?
> 
64 bytes is the minimum packet size of an ethernet frame (which includes 
the CRC).  ARP requests don't take up that much space so the kernel pads 
them out to be large enough.  A tcpdump will show you exactly how it looks.

> I'm having a problem where a cisco switch is ignoring me because (according
> to the guys who operate it) the arp spec for 802.3 is 64 bytes and im not
> doing that.
> 
802.3 stipulates 64 bytes for all ethernet frames.  If you have a 
program that is somehow sending frames smaller than that, yes, you (or 
something) is broken.  How exactly are you sending frames that you think 
are too small?

Neil
> Im not subscribed to the list, so if I could be cc'd I'd appreciate it.
> 
> Hope someone can help me, and thanks for taking the time to read this.
> 
> Tim
> 
> -
> To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
> the body of a message to majordomo@vger.kernel.org
> More majordomo info at  http://vger.kernel.org/majordomo-info.html
> Please read the FAQ at  http://www.tux.org/lkml/


-- 
/***************************************************
  *Neil Horman
  *Software Engineer
  *Red Hat, Inc.
  *nhorman@redhat.com
  *gpg keyid: 1024D / 0x92A74FA1
  *http://pgp.mit.edu
  ***************************************************/

RE: ipv4 arp and linux

[Tim Warnock]

> Tim Warnock wrote:
> > What arp packet size does a linux 2.4 series kernel use? 
> > How would it be made bigger?
> > 
> 64 bytes is the minimum packet size of an ethernet frame 
> (which includes the CRC).  ARP requests don't take up that much 
> space so the kernel pads them out to be large enough.
> A tcpdump will show you exactly how it looks.
> 

Invoked:
tcpdump -i eth4 -nn arp -s1500 -XX

05:59:11.438737 arp who-has 203.63.65.194 tell 203.63.65.193
0x0000   0001 0800 0604 0001 000c f1ab 7607 cb3f        ............v..?
0x0010   41c1 0000 0000 0000 cb3f 41c2                  A........?A.

05:59:11.439060 arp reply 203.63.65.194 is-at 0:7:eb:63:40:82
0x0000   0001 0800 0604 0002 0007 eb63 4082 cb3f        ...........c@..?
0x0010   41c2 000c f1ab 7607 cb3f 41c1 0000 0000        A.....v..?A.....
0x0020   0000 0000 0000 0000 0000 0000 0000             ..............

Those aren't 64 bytes, but would tcpdump show the padding?

> 802.3 stipulates 64 bytes for all ethernet frames.  If you have a 
> program that is somehow sending frames smaller than that, 
> yes, you (or something) is broken.  How exactly are you sending frames 
> that you think are too small?

I havent done anything (just stock kernels), but the network operators claim
they have seen this before out of linux boxes and that it was caused by
illegally short arp frames.

I've used linux for years and this is the first time that I have had any
issues with any switch/router.

The problem that im facing is that the other side is learning my mac
address, but I fail to learn theirs and end up with packet loss. (I see lots
of arp who-has) but the other end never receive it.

Hard coding their mac address in solved the issue.

Thanks
Tim

> Neil
> /***************************************************
>   *Neil Horman
>   *Software Engineer
>   *Red Hat, Inc.
>   *nhorman@redhat.com
>   *gpg keyid: 1024D / 0x92A74FA1
>   *http://pgp.mit.edu
>   ***************************************************/

Re: ipv4 arp and linux

[Bernd Eckenfels]

In article <UENERkVCMDkAAQACAAAAAAAAAAAAAAAAABgAAAAAAAAA4+E3P43380+sBshf1RHa98KAAAAQAAAAYtAmuHujdUS5GzoYL+cKTQEAAAAA@getonit.net.au> you wrote:
> Those aren't 64 bytes, but would tcpdump show the padding?

# tcpdump -v -v -i eth0 -s1500 -X -X arp
tcpdump: listening on eth0, link-type EN10MB (Ethernet), capture size 1500 bytes
23:04:28.977213 arp who-has 10.0.0.2 tell darkover.inka.de
        0x0000:  ffff ffff ffff 00e0 4c39 12b5 0806 0001  ........L9......
        0x0010:  0800 0604 0001 00e0 4c39 12b5 0a00 0004  ........L9......
        0x0020:  0000 0000 0000 0a00 0002 0000 0000 0000  ................
        0x0030:  0000 0000 0000 0000 0000 0000            ............


You should not forget the LL headers.

Greetings
Bernd