balance-alb and arp-reply stomping

balance-alb and arp-reply stomping

[Matthew O'Connor]

Hi!  I've encountered what appears to be a known "issue" with
balance-alb, whereby when a bond configured thus is put into a bridge
with virtual ethernet adapters, on reply to arp requests the bond
appears to "stomp" the MAC of the outgoing replies with one of its own
adapters' MACs.  The consequence seems to be intermittent
connectivity, easily witnessed by ping-loss early in a virtual
adapter's life.  Checking the ARP cache on another machine shows that
the virtual adapter's MAC has been replaced with one of the bond
slaves'.  Other bonding modes do not exhibit this behavior.

I was wondering if this is something that had been brought up before
for fixing, and whether or not you would accept a patch if an
appropriate fix was implemented?  My naive understanding would suggest
checking the outgoing reply against a table of known slaves, and if
the MAC did not exist there then map it to a slave and transmit the
reply unmodified.

One thing I find strange about this problem: when pinging a host that
is behind said bond and bridge, I occasionally see the virtual
adapter's true MAC appear intermittently even though it would seem
gratuitous ARPs are also getting stomped.  The MAC appears and then
quickly disappears, replaced with one of the bond's slaves.  What's
more, after the virtual adapter has been a member of the bridge for a
good while (several minutes, it seems), the intermittent connectivity
seems less of an issue - for instance, I just pinged one host that
exhibited this problem the other day, and it replied to 370 pings
without a single lost packet.  Ordinarily, when the issue occurs,
50-70% of the packets appear to be lost.

I am not currently a member of this list - please CC me on replies!  THANKS!!

-- Matt

Re: balance-alb and arp-reply stomping

[Jay Vosburgh]

Matthew O'Connor <liquidhorse@gmail.com> wrote:

>Hi!  I've encountered what appears to be a known "issue" with
>balance-alb, whereby when a bond configured thus is put into a bridge
>with virtual ethernet adapters, on reply to arp requests the bond
>appears to "stomp" the MAC of the outgoing replies with one of its own
>adapters' MACs.  The consequence seems to be intermittent
>connectivity, easily witnessed by ping-loss early in a virtual
>adapter's life.  Checking the ARP cache on another machine shows that
>the virtual adapter's MAC has been replaced with one of the bond
>slaves'.  Other bonding modes do not exhibit this behavior.
>
>I was wondering if this is something that had been brought up before
>for fixing, and whether or not you would accept a patch if an
>appropriate fix was implemented?  My naive understanding would suggest
>checking the outgoing reply against a table of known slaves, and if
>the MAC did not exist there then map it to a slave and transmit the
>reply unmodified.

	This should be fixed in current kernels (to have balanace-alb
mode not modify ARPs that do not originate locally); I see the patch in
the 3.8-rc2 source, but not in the linux-3.7.1 source.

	You could apply the patch to an older kernel, it's pretty
simple.  The patch itself can be found here:

http://git.kernel.org/?p=linux/kernel/git/stable/linux-stable.git;a=patch;h=567b871e503316b0927e54a3d7c86d50b722d955

	-J

---
	-Jay Vosburgh, IBM Linux Technology Center, fubar@us.ibm.com