On Tue, Dec 03, 2002 at 12:27:24PM -0200, andre.correa@pobox.com wrote: > root@linuxbox:~# tcpdump -i eth1 | grep arp > tcpdump: listening on eth1 > Dec 3 11:16:52 linuxbox kernel: device eth1 entered promiscuous mode <snip> > 11:17:10.390134 arp reply 204.152.184.64 is-at 0:2:b9:1d:db:41 > 11:17:10.640043 arp who-has 200.225.157.104 tell linuxbox > 11:17:10.640967 arp reply 200.225.157.104 is-at 0:2:b9:1d:db:41 > 11:17:10.689240 arp who-has 200.225.157.165 tell linuxbox > 11:17:10.690768 arp reply 200.225.157.165 is-at 0:2:b9:1d:db:41 > 11:17:10.893170 arp who-has 200.225.157.163 tell linuxbox > 11:17:10.894088 arp reply 200.225.157.163 is-at 0:2:b9:1d:db:41 > 11:17:10.980746 arp who-has 200.225.157.167 tell linuxbox > 11:17:10.981714 arp reply 200.225.157.167 is-at 0:2:b9:1d:db:41 > 11:17:11.504255 arp who-has a.gtld-servers.net tell linuxbox > 11:17:11.505926 arp reply a.gtld-servers.net is-at 0:2:b9:1d:db:41 > > 2183 packets received by filter > 0 packets dropped by kernel > > We see my linux box asking for MAC addresses of hosts outside > its "local" network and my gateway, a Cisco 2621 answering those > broadcasts with its own MAC address. Yes, very peculiar. Your linuxbox appears to think the Internet is one big switched network :) What does netstat -rn give you? > For what I know, both are doing wrong. My box is not supposed to ask > for those MACs and the Cisco is not supposed to answer. Yes. Weren't you using PPPoE or similar? Not familiar with that at all but that might be related. > Does anybody have seen these before or have any ideas what would cause > it? Out of interest, where have you looked for answered to this problem? Looking for overflowing arp tables via www.google.com or similar might give you the answers you need. -- FunkyJesus System Administration Team
