Although I know this particular remote host has tried to connect in
previously, it is currently not sending any traffic (otherwise tcpdump would
show it)
# tcpdump -i eth0 -n -e icmp
tcpdump: listening on eth0
14:40:44.895803 0:a0:c9:12:52:c6 0:c0:95:f0:1c:de 0800 220: xxx.xxx.xxx.162 > yyy.yyy.yyy.86: icmp: host xxx.xxx.xxx.163 unreachable [tos 0xc0]
14:40:54.905803 0:a0:c9:12:52:c6 0:c0:95:f0:1c:de 0800 220: xxx.xxx.xxx.162 > yyy.yyy.yyy.86: icmp: host xxx.xxx.xxx.163 unreachable [tos 0xc0]
14:41:04.975803 0:a0:c9:12:52:c6 0:c0:95:f0:1c:de 0800 220: xxx.xxx.xxx.162 > yyy.yyy.yyy.86: icmp: host xxx.xxx.xxx.163 unreachable [tos 0xc0]
14:41:14.915803 0:a0:c9:12:52:c6 0:c0:95:f0:1c:de 0800 220: xxx.xxx.xxx.162 > yyy.yyy.yyy.86: icmp: host xxx.xxx.xxx.163 unreachable [tos 0xc0]
14:41:24.935803 0:a0:c9:12:52:c6 0:c0:95:f0:1c:de 0800 220: xxx.xxx.xxx.162 > yyy.yyy.yyy.86: icmp: host xxx.xxx.xxx.163 unreachable [tos 0xc0]
14:41:34.955803 0:a0:c9:12:52:c6 0:c0:95:f0:1c:de 0800 220: xxx.xxx.xxx.162 > yyy.yyy.yyy.86: icmp: host xxx.xxx.xxx.163 unreachable [tos 0xc0]
.163 is a host connected to eth1 on this box which is currently down, hence
no ARP responses. It is listed as "incomplete" in the arp table:
# arp -n
Address HWtype HWaddress Flags Mask Iface
...
xxx.xxx.xxx.163 (incomplete) eth1
...
xxx.xxx.xxx.163 ether 00:A0:C9:12:52:C6 CMP eth0
...
and seems to remain there permanently.
The only dodgy thing going on is that I _also_ have a proxyARP entry for this
IP address on a different interface (also shown above).
Could it be that the ARP entry is timing out, generating a host unreachable,
trying to remove itself from the ARP cache but failing because of the
existing proxy entry, and is thus doomed to repeat forever?
Brian.
-
To unsubscribe from this list: send the line "unsubscribe linux-net" in
the body of a message to majordomo@vger.rutgers.edu