LinuxQuestions.org
Welcome to the most active Linux Forum on the web.
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Networking
User Name
Password
Linux - Networking This forum is for any issue related to networks or networking.
Routing, network cards, OSI, etc. Anything is fair game.

Notices


Reply
  Search this Thread
Old 04-03-2016, 05:10 AM   #1
hoggle64
LQ Newbie
 
Registered: Apr 2016
Posts: 1

Rep: Reputation: Disabled
Question strange ARP response


Hi guys,

I have a very strange problem. One of my linux machines inside my LAN thinks at has 2 IP's even though only one is configured. The network setup is simple. Just one adapter:

Code:
pi@backup:/etc/network $ cat interfaces
auto lo
iface lo inet loopback

auto eth0
allow-hotplug eth0
iface eth0 inet static
address 192.168.0.88
netmask 255.255.255.0
gateway 192.168.0.1
dns-nameservers 192.168.0.1
dns-domain huckmuc.lan

#auto eth1
#iface eth1 inet manual

Code:
pi@backup:/etc $ cat networks
default         0.0.0.0
loopback        127.0.0.0
link-local      169.254.0.0
Code:
pi@backup:/etc $ sudo arp -a
fileserver.huckmuc.lan (192.168.0.87) at b8:27:eb:9f:68:24 [ether] on eth0
vigor.huckmuc.lan (192.168.0.1) at 00:1d:aa:dd:1a:e0 [ether] on eth0
? (192.168.0.113) at 8c:89:a5:0b:5c:27 [ether] on eth0
smarthome.huckmuc.lan (192.168.0.89) at b8:27:eb:b0:60:91 [ether] on eth0
Looks simple as hell to me.

Now - for any strange reason - when I do an arp request in the same network, this machine also responds to 192.168.0.123 which is not assigned:

Wireshark from my Windows Notebook:

Code:
"2","0.551391","Micro-St_0b:5c:27","Broadcast","ARP","42","Who has 192.168.0.123? Tell 192.168.0.113"
"3","0.551665","Raspberr_f2:46:d5","Micro-St_0b:5c:27","ARP","60","192.168.0.123 is at b8:27:eb:f2:46:d5"
It also answers to the configured IP address with the same MAC:
Code:
"6","1.140399","Micro-St_0b:5c:27","Broadcast","ARP","42","Who has 192.168.0.88? Tell 192.168.0.113"
"7","1.140631","Raspberr_f2:46:d5","Micro-St_0b:5c:27","ARP","60","192.168.0.88 is at b8:27:eb:f2:46:d5"
I have to mention that during the installation of this new machine it got an IP assigned via DHCP (which is possibly 192.168.0.123). But now it is configured as static.

This is completely not understandable. Hope some network guru has a hint for me.
 
Old 04-04-2016, 05:58 AM   #2
business_kid
LQ Guru
 
Registered: Jan 2006
Location: Ireland
Distribution: Slackware, Slarm64 & Android
Posts: 16,271

Rep: Reputation: 2322Reputation: 2322Reputation: 2322Reputation: 2322Reputation: 2322Reputation: 2322Reputation: 2322Reputation: 2322Reputation: 2322Reputation: 2322Reputation: 2322
Have you tried
Code:
cd /etc
grep -r '192\.168\.0\.123' *
and see where you have that configured?
 
Old 04-04-2016, 11:23 AM   #3
lazydog
Senior Member
 
Registered: Dec 2003
Location: The Key Stone State
Distribution: CentOS Sabayon and now Gentoo
Posts: 1,249
Blog Entries: 3

Rep: Reputation: 194Reputation: 194
Also look at your routing table.

Code:
route -n
Might have a route listed in there.
 
Old 04-11-2016, 03:44 AM   #4
pingu_penguin
Member
 
Registered: Aug 2004
Location: pune
Distribution: Slackware
Posts: 350

Rep: Reputation: 60
I dont think arp has anything to do with assigning IPs. It is just used to discover devices on network.

If your system does get two ips then

#ifconfig

on that particular machine should show it.

I have a wierd feeling about arp-poisoning here, ( hope im wrong)

Is that a Raspberry Pi device indicated there in your wireshark capture ?
 
Old 04-12-2016, 04:48 PM   #5
jefro
Moderator
 
Registered: Mar 2008
Posts: 21,976

Rep: Reputation: 3623Reputation: 3623Reputation: 3623Reputation: 3623Reputation: 3623Reputation: 3623Reputation: 3623Reputation: 3623Reputation: 3623Reputation: 3623Reputation: 3623
Only two choices exist. Either it is on that Pi or from outside your lan. How is this topology? Disconnect the wan and see if it still exists. Better still use cable from Pi to only other system and see if it still exists.
 
  


Reply


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off



Similar Threads
Thread Thread Starter Forum Replies Last Post
[SOLVED] Disable ARP response on one of IPs Lieta Linux - Networking 3 11-29-2013 06:06 AM
Strange ARP behavior : A linux server responds to all ARP requests Hdvd21 Linux - Networking 4 10-24-2013 05:02 AM
same MAC address for different IP addresses in ARP response VinodVandkar Linux - Networking 5 01-25-2013 04:32 PM
strange gratuitous arp requests continually sent by my Centos 5 Server wknight39 Linux - Networking 1 08-02-2011 10:12 AM
strange arp codeine Linux - Networking 1 07-04-2004 12:45 PM

LinuxQuestions.org > Forums > Linux Forums > Linux - Networking

All times are GMT -5. The time now is 11:52 PM.

Main Menu
Advertisement
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
Open Source Consulting | Domain Registration