"Neighbour table overflow." blocking internet

Riddick · 10-22-2005, 11:11 PM

I have a Slackware 10.2 computer that is acting as a router, basically, for 5 heavy internet users.
It's been running OK for about 15 days or so, but now in /var/log/syslog it starts saying:

Code:

NET: 28 messages suppressed.
Neighbour table overflow.
NET: 52 messages suppressed.
Neighbour table overflow.
NET: 26 messages suppressed.
Neighbour table overflow.
NET: 24 messages suppressed.
Neighbour table overflow.
NET: 14 messages suppressed.
Neighbour table overflow.
NET: 25 messages suppressed.
Neighbour table overflow.
NET: 5 messages suppressed.
Neighbour table overflow.
Neighbour table overflow.
Neighbour table overflow.
NET: 37 messages suppressed.
Neighbour table overflow.
NET: 69 messages suppressed.
Neighbour table overflow.
NET: 47 messages suppressed.
Neighbour table overflow.
NET: 70 messages suppressed.
Neighbour table overflow.
NET: 133 messages suppressed.
Neighbour table overflow.
NET: 114 messages suppressed.
Neighbour table overflow.
NET: 64 messages suppressed.
Neighbour table overflow.
NET: 46 messages suppressed.
Neighbour table overflow.
NET: 89 messages suppressed.
Neighbour table overflow.
NET: 57 messages suppressed.
Neighbour table overflow.
Neighbour table overflow.
Neighbour table overflow.
Neighbour table overflow.
Neighbour table overflow.
Neighbour table overflow.
NET: 86 messages suppressed.
Neighbour table overflow.
NET: 93 messages suppressed.
Neighbour table overflow.
NET: 52 messages suppressed.
Neighbour table overflow.
NET: 28 messages suppressed.
Neighbour table overflow.
NET: 17 messages suppressed.
Neighbour table overflow.
NET: 45 messages suppressed.
Neighbour table overflow.
Neighbour table overflow.
Neighbour table overflow.
Neighbour table overflow.
Neighbour table overflow.
Neighbour table overflow.
Neighbour table overflow.
Neighbour table overflow.
NET: 13 messages suppressed.
Neighbour table overflow.
NET: 54 messages suppressed.
Neighbour table overflow.

...ad infinitum and is making everyone refesh their pages, and sometimes
blocks the internet completely.

We are using a (rather crappy) Ethernet ADSL modem.

ifconfig:

Code:

eth0      Link encap:Ethernet  HWaddr 00:11:D8:3D:F0:08
          inet addr:87.80.246.40  Bcast:87.80.246.40  Mask:255.255.255.255
          UP BROADCAST NOTRAILERS RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:56777650 errors:0 dropped:0 overruns:0 frame:0
          TX packets:57590225 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000
          RX bytes:39711609 (37.8 Mb)  TX bytes:3095387467 (2951.9 Mb)
          Interrupt:5 Base address:0x4000

eth1      Link encap:Ethernet  HWaddr 00:11:D8:3D:E4:49
          inet addr:192.168.0.1  Bcast:192.168.0.255  Mask:255.255.255.0
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:333033081 errors:0 dropped:0 overruns:0 frame:0
          TX packets:328625992 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000
          RX bytes:3906266567 (3725.3 Mb)  TX bytes:1628383204 (1552.9 Mb)
          Interrupt:5 Memory:e0000000-0

lo        Link encap:Local Loopback
          inet addr:127.0.0.1  Mask:255.0.0.0
          UP LOOPBACK RUNNING  MTU:16436  Metric:1
          RX packets:427796 errors:0 dropped:0 overruns:0 frame:0
          TX packets:427796 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0
          RX bytes:32586283 (31.0 Mb)  TX bytes:32586283 (31.0 Mb)

What could be causing this... I think the solutions are either to forget neighbours fatser,
or to enlarge the size of the neigh table, but I have no idea what to do!

Some help would be appreciated.

Riddick

tredegar · 10-23-2005, 05:55 AM

Google "Neighbour table overflow".
First Link leads to this:

http://lists.debian.org/debian-isp/2.../msg00359.html

Quote:

Hi there,

Here's what I found in a posting on another Debian list:

1. Add the following lines to your /etc/network/interfaces file:

auto lo
iface lo inet loopback

2. Make sure that "127.0.0.1" (without quotes) in your /etc/hosts has "local host"
(without the quotes) to the right

3. Run the following:

ifup lo

That did it for me, and should also for you. I hope it helps.

Katim

Did you try this?

Riddick · 10-23-2005, 08:45 AM

Yes, I did google it, and I have no etc/network/interfaces,
because I am on Slackware 10.2...

Please, some serious help

tredegar · 10-23-2005, 09:14 AM

Quote:

Yes, I did google it, and I have no etc/network/interfaces,
because I am on Slackware 10.2...

Well, I'm running Mandrake, and I have no etc/network/interfaces either, but I do have stuff under /etc/sysconfig/networking/ including this file, ifcfg-lo which looks as though it might be the Mandrake (& Slack?) equivalent :

Code:

DEVICE=lo
IPADDR=127.0.0.1
NETMASK=255.0.0.0
NETWORK=127.0.0.0
# If you're having problems with gated making 127.0.0.0/8 a martian,
# you can change this to something else (255.255.255.255, for example)
BROADCAST=127.255.255.255
ONBOOT=yes
NAME=loopback

Maybe you should have something similar.

Also, from that link:

Quote:

Make sure that "127.0.0.1" (without quotes) in your /etc/hosts has "localhost" (without the quotes) to the right

Maybe you should check that also, and then either ifup lo, or reboot.

Quote:

Please, some serious help

I'm doing my best here.

Riddick · 10-23-2005, 09:19 AM

Ok sorry about that... I was a bit mean.

So, I have done "locate ifcfg-lo" and "locate networking" and found I have
no folders called "networking" and no file called "ifcfg-lo".

127.0.0.1 is indeed in "hosts"

I don't know where to look for these configuration files!

koodoo · 11-17-2005, 03:40 PM

Hi sorry for jumping in, but I'm also having similar problems. I am working on Slackware 10.1. When I type dmesg I get a lot of Neighbour Table Overflow errors and I also get an error concerning eth0. Here's a snapshot of the errors :

Code:

Neighbour table overflow.
NET: 21181 messages suppressed.
Neighbour table overflow.
NETDEV WATCHDOG: eth0: transmit timed out
eth0: Tx timed out, cable problem? TSR=0x6, ISR=0x0, t=24.
NET: 43317 messages suppressed.
Neighbour table overflow.
Neighbour table overflow.
Neighbour table overflow.

I searched google as well as these forums for "Neighbour Table Overflow" problems. What I understood was that this problem is because the arp cache gets overflowed because of :
1) Some application that generates much traffic (eg. Lisa)
2) Some machine in your subnet that generates a lot of traffic and
3) Related things

Possible solutions included :
1) Increasing the size of the arp cache
2) Shutting down services like Lisa and,
3) Identifying machines generating a lot of traffic and shutting them down.

I tried 1 & 2 of these but none worked for me. I couldn't try 3 as I first have to identify those machines causing excess traffic, and then find out who their owners are. I found the following threads that deal with almost the same problem :

1) http://www.linuxquestions.org/quest...+table+overflow
2) http://www.linuxquestions.org/quest...+table+overflow
3) http://www.linuxquestions.org/quest...+table+overflow
4) http://www.linuxquestions.org/quest...+table+overflow
5) http://www.linuxquestions.org/quest...+table+overflow
6) http://www.linuxquestions.org/quest...+table+overflow

Seems like a lot of people are having problems with this.
Also some people suggested that the problem might be because of older kernel versions. I am using 2.4.26. When I increased the size of the arp cache I got a new error in the output of dmesg :

Code:

NET: 21181 messages suppressed.
Neighbour table overflow.
NETDEV WATCHDOG: eth0: transmit timed out
eth0: Tx timed out, cable problem? TSR=0x6, ISR=0x0, t=24.
NET: 43317 messages suppressed.
Neighbour table overflow.
Neighbour table overflow.
NET: 64489 messages suppressed.
Neighbour table overflow.
NET: 16005 messages suppressed.
Neighbour table overflow.
device eth0 entered promiscuous mode
device eth0 left promiscuous mode
device eth0 entered promiscuous mode
device eth0 left promiscuous mode
device eth0 entered promiscuous mode
device eth0 left promiscuous mode

This thread said something about checking that whether your net card was working in promiscous mode or not, but I couldn't understand much of it.

tcpdump generates output that has loads of :

Code:

02:09:33.529670 arp who-has <one i.p.> tell <another i.p.>

with some particular i.p.'s repeated over and over again. (I guess these might be the culprits !). Interestingly when a few minutes earlier I typed the arp -a command, I got no entries listed. While just now I got only one entry (Seems that my arp cache is empty!)

Has anybody been able to solve this problem ?
Thanks for any help !