strange ARP response

hoggle64 · 04-03-2016, 05:10 AM

Hi guys,

I have a very strange problem. One of my linux machines inside my LAN thinks at has 2 IP's even though only one is configured. The network setup is simple. Just one adapter:

Code:

pi@backup:/etc/network $ cat interfaces
auto lo
iface lo inet loopback

auto eth0
allow-hotplug eth0
iface eth0 inet static
address 192.168.0.88
netmask 255.255.255.0
gateway 192.168.0.1
dns-nameservers 192.168.0.1
dns-domain huckmuc.lan

#auto eth1
#iface eth1 inet manual

Code:

pi@backup:/etc $ cat networks
default         0.0.0.0
loopback        127.0.0.0
link-local      169.254.0.0

Code:

pi@backup:/etc $ sudo arp -a
fileserver.huckmuc.lan (192.168.0.87) at b8:27:eb:9f:68:24 [ether] on eth0
vigor.huckmuc.lan (192.168.0.1) at 00:1d:aa:dd:1a:e0 [ether] on eth0
? (192.168.0.113) at 8c:89:a5:0b:5c:27 [ether] on eth0
smarthome.huckmuc.lan (192.168.0.89) at b8:27:eb:b0:60:91 [ether] on eth0

Looks simple as hell to me.

Now - for any strange reason - when I do an arp request in the same network, this machine also responds to 192.168.0.123 which is not assigned:

Wireshark from my Windows Notebook:

Code:

"2","0.551391","Micro-St_0b:5c:27","Broadcast","ARP","42","Who has 192.168.0.123? Tell 192.168.0.113"
"3","0.551665","Raspberr_f2:46:d5","Micro-St_0b:5c:27","ARP","60","192.168.0.123 is at b8:27:eb:f2:46:d5"

It also answers to the configured IP address with the same MAC:

Code:

"6","1.140399","Micro-St_0b:5c:27","Broadcast","ARP","42","Who has 192.168.0.88? Tell 192.168.0.113"
"7","1.140631","Raspberr_f2:46:d5","Micro-St_0b:5c:27","ARP","60","192.168.0.88 is at b8:27:eb:f2:46:d5"

I have to mention that during the installation of this new machine it got an IP assigned via DHCP (which is possibly 192.168.0.123). But now it is configured as static.

This is completely not understandable. Hope some network guru has a hint for me.

business_kid · 04-04-2016, 05:58 AM

Have you tried

Code:

cd /etc
grep -r '192\.168\.0\.123' *

and see where you have that configured?

lazydog · 04-04-2016, 11:23 AM

Also look at your routing table.

Code:

route -n

Might have a route listed in there.

pingu_penguin · 04-11-2016, 03:44 AM

I dont think arp has anything to do with assigning IPs. It is just used to discover devices on network.

If your system does get two ips then

#ifconfig

on that particular machine should show it.

I have a wierd feeling about arp-poisoning here, ( hope im wrong)

Is that a Raspberry Pi device indicated there in your wireshark capture ?

jefro · 04-12-2016, 04:48 PM

Only two choices exist. Either it is on that Pi or from outside your lan. How is this topology? Disconnect the wan and see if it still exists. Better still use cable from Pi to only other system and see if it still exists.