Hi there!

Having some issues with something I have configured wrong in RH9, which is causing my RH9 to send very frequent ARP requests to my poor external DNS server. Apart from making my wireless LAN slow, this is also causing wasted bandwidth!!

Basically, my RH9 computer believes it wants to contact a host called 'localhost', so first it sends an ARP to the DNS server (syd.optushome.com.au), which of course replies, no such name. The next step my computer then takes is to attempt to find the host using the resolv.conf file - which has my ISP servers name in it as a default search, so naturally it tries to find localhost there... hence the search for localhost.qld.optushome.com.au.... (or at least I think this is the reason) please see TCPdump below:-

21:37:00.364267 192.168.0.100.33839 > dns.syd.optusnet.com.au.domain: 37785+ A? localhost.qld.optushome.com.au. (48) (DF)
21:37:00.366441 192.168.0.100.33840 > dns.syd.optusnet.com.au.domain: 37626+ PTR? 132.75.2.203.in-addr.arpa. (43) (DF)
21:37:00.393084 dns.syd.optusnet.com.au.domain > 192.168.0.100.33840: 37626* 1/3/2 (182)
21:37:00.393955 192.168.0.100.33840 > dns.syd.optusnet.com.au.domain: 37627+ PTR? 100.0.168.192.in-addr.arpa. (44) (DF)
21:37:00.403176 dns.syd.optusnet.com.au.domain > 192.168.0.100.33839: 37785 NXDomain* 0/1/0 (108)
21:37:00.403392 192.168.0.100.33841 > dns.syd.optusnet.com.au.domain: 37786+ A? localhost. (27) (DF)
21:37:00.423050 dns.syd.optusnet.com.au.domain > 192.168.0.100.33840: 37627 NXDomain 0/1/0 (121)
21:37:00.433051 dns.syd.optusnet.com.au.domain > 192.168.0.100.33841: 37786 NXDomain 0/1/0 (102)

and this goes on... and on... and on....

can anyone give me any idea where I could start to try and find the service that is trying to access localhost and causing these needless ARP requests?

All the best,

Matt

Ha...

have answered my own question.

Had inadvertantly removed the reference to localhost from the etc/hosts file, some daemon somewhere was trying to do a loop-back using localhost every few seconds, and therefore caused the ARP.

adding the following line to the /etc/hosts file solved the problem:-

localhost 127.0.0.1

I wonder how many hundred GIGABYTES of bandwidth I must have blown to smithereens over the last two years of this machine being on 24/7 before I noticed it was flooding my ISP's DNS server with ARP requests? All of a sudden things seem a lot quicker.

Hope this helps someone else if they are a ninny also :-)

Matt

I can't help but have a bit of a giggle at the irony of this one:-

The real world equivalent of what I've been doing for the last few years is posting a letter to the post office every four seconds, asking them to tell me where the hell I live, and putting my return address on the back of the envelope :-)

Matt

By the way, those are not "ARP" requests: They're DNS requests. ARP is a link-layer protocol, layer2. DNS is a layer7 protocol (application layer).

A? localhost.qld.optushome.com.au. (48) (DF)
The "A?" doesn't stand for "ARP", it stands for "type-A Resource Record" (i.e. a name-to-IP mapping).

You can tell this be looking here
192.168.0.100.33839 > dns.syd.optusnet.com.au.domain
tcpdump will appened the service name to the hostname in the output, unless you turn off resolution with -n. "Domain" is the shortened name for "Domain Name Service".

Here's an example of an actual ARP request
09:49:48.468367 arp who-has sekhmet.amaunetsgothique.com tell 10.8.1.12