I experienced a similar situation once. My setup was as follows:
Linux box running RH 5.2, kernel 2.2.3 (not very sure, it was in March),
Netgear NIC (tulip driver), Baystack 303 Ethernet switches.
An old Prosignia VS server running Netware 3.12 was connected to the same
switch.
Linux box was using IPX, autoconfigured, with all three types of frame.
At some point in time the whole network got poisoned with multicast
packets originating from Netware with undeliverable target MAC address.
My investigation revealed the following.
Packets sent from Linux box got distorted, as if delayed on the wire. MAC
address in the header of the packet was shifted two or three bytes.
Netware server received those packets with invalid (non-existent) MAC
address and replied to them. The packets were undeliverable, of course.
What I changed after all, I turned off autoconfigure option of IPX and
left etherII frame only. Poisoning never repeated since then.
On 20 Jul 1999, Harvey J. Stein wrote:
>
> My linux box (RH 6.0 with RH supplied kernel, version 2.2.5) is
> putting a weird packet out the ethernet port which is causing a Cisco
> ethernet switch to go insane, spewing out packets wildly & bringing
> the network down. This isn't exactly wining lots of friends for Linux
> over here. I also can reproduce this effect fairly easily, at least I
> could until my box was banned from the net for this!
>
> Here's a hex dump of the packet:
>
> 01 80 C2 00 00 01 00 A4 00 80 D2 9C 88 08 00 01
> 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
> 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
> 00 00 00 00 00 00 00 00 00 00 00 00
>
> The network guys here got that from a sniffer they put on the line.
> They say the weird things about the packet are the ethertype of 8808,
> that it's shorter than the minimum packet size of 64 bytes, and that
> it's a multicast broadcast packet. So, why my box is putting it on
> the wire (especially given that I'm not doing any multicast), and how
> do I stop it? BTW, rebuilding the kernel without multicast support
> doesn't stop these weird packets from going out.
>
> Hardware details:
>
> A Compaq deskpro EN. PII 450 with 100mhz bus speed. dmesg has this
> to say about the ethernet:
>
> The PCI BIOS has not enabled this device! Updating PCI command
> 0003->0007.
> eth0: Invalid EEPROM checksum 0x60fe, check settings before activating this device!
> eth0: Intel EtherExpress Pro 10/100 at 0x2000, 00:A4:00:80:D2:9C, IRQ 11.
> Receiver lock-up bug exists -- enabling work-around.
> Board assembly 800080-000, Physical connectors present:
> Primary interface chip None PHY #0.
> General self-test: passed.
> Serial sub-system self-test: passed.
> Internal registers self-test: passed.
> ROM checksum self-test: passed (0x04f4518b).
> Receiver lock-up workaround activated.
>
>
> Thanks,
>
> --
> Harvey J. Stein
> Bloomberg LP
> hjstein@bfr.co.il
>
> -
> To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
> the body of a message to majordomo@vger.rutgers.edu
> Please read the FAQ at http://www.tux.org/lkml/
>
--------------------------------------------
Kastus Shchuka <pike@usis.minsk.by>
LAN Manager/SysAdmin ph.: +375-17-217-0481
USIS Minsk fax: +375-17-217-8828
-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.rutgers.edu
Please read the FAQ at http://www.tux.org/lkml/