ARP packets

Rick Stevens ricks at nerd.com
Fri Sep 24 00:50:08 UTC 2010


On 09/23/2010 04:14 PM, Bret Stern wrote:
> Ladies and gentlemen,
>
>
> Playing with Wireshark and seeing
>   "Gratuitous ARP for 63.209.4.211 (Request)"
> coming from my Fedora 12 ftp server.
>
> The ip address is a bit of a mystery since this is a fresh install, and
> I couldn't find any nic card setup in the bios which could contain this
> number. Must be in the server somewhere.
>
> Who's gonna solve this one? Where can I look?

There are a couple possibilities.  If a machine has two NICs on the
same IP you'll get that message.  The offender could be another physical 
NIC or an alias of another NIC (e.g. "eth0:0").

Another possibility is that you have a bond running (two NICs set up as
either a failover pair or an aggregate).  If the system fails over from
one NIC to the other one (or if it switches when load sharing), an ARP
may be sent--depending on the bond type.

----------------------------------------------------------------------
- Rick Stevens, Systems Engineer, C2 Hosting          ricks at nerd.com -
- AIM/Skype: therps2        ICQ: 22643734            Yahoo: origrps2 -
-                                                                    -
-      "Microsoft is a cross between The Borg and the Ferengi.       -
-  Unfortunately they use Borg to do their marketing and Ferengi to  -
-               do their programming."  -- Simon Slavin              -
----------------------------------------------------------------------




More information about the Redhat-install-list mailing list