[Gllug] Weird network behaviour

[Nix]

On Thu, 20 Apr 2006, Rich Walker whispered secretively:
> John Winters <john at sinodun.org.uk> writes:
> 
>> I have seen symptoms like that in the past for various reasons.  One
>> vague recollection - if two machines think they have the same IP address
>> you can end up with ARP wars and half your packets going to the wrong
>> place.  The regular pings then keep setting the ARP cache back to your
>> address and the data flows.
> 
> That would fit the "every 30-45 seconds a burst of data turns up" that
> was going on. (Mind you, it's not the only thing that would fit that...)

Yeah; I had a problem like that once where two machines on a subnet of
their own were talking in 30-second bursts every 30 seconds. It turned
out that the router connecting them to the rest of the network had proxy
arp turned on on the wrong interface (it shouldn't have been turned on
at all), so was claiming to be everyone on that subnet *to* everyone on
that subnet.

(What's worse is that this was a remote colo and we had no access to the
router in question. The 30-second timeout was a bit of a giveaway and I
had a lucky break and checked arp first thing and the problem was sort
of obvious a couple of minutes' later. Everyone thought I was some sort
of problem-solving god after that, no matter how much I said it was
luck. --- OK, OK, so perhaps I didn't protest all that hard...)

-- 
`On a scale of 1-10, X's "brokenness rating" is 1.1, but that's only
 because bringing Windows into the picture rescaled "brokenness" by
 a factor of 10.' --- Peter da Silva
-- 
Gllug mailing list  -  Gllug at gllug.org.uk
http://lists.gllug.org.uk/mailman/listinfo/gllug