|Subject:||PROBLEM: Bad ARP requests make an entry in routing cache|
|From:||Szymon Miotk <spam@xxxxxxxxxxxxx>|
|Date:||Wed, 30 Mar 2005 16:45:48 +0200|
|Organization:||Crocom Computer Systems s.c.|
|User-agent:||Mozilla Thunderbird 1.0.2-1.3.2 (X11/20050324)|
[1.] One line summary of the problem: Bad ARP requests make an entry in routing cache
[2.] Full description of the problem/report:
When there is client/router netmask mismatch (client has wider mask than the route), ARP request to non-existing local networks make an entry in routing cache on the router.
Example configuration in [6.]
[3.] Keywords (i.e., modules, networking, kernel): networking, arp, routing
[4.] Kernel version (from /proc/version):
work also on 2.6.10_rc1_bk17, 2.6.11.
I have not tried earlier versions, because I need some bug-fixes introduced in 2.6.10_rc1_bk17
[5.] Output of Oops.. message (if applicable) with symbolic information resolved (see Documentation/oops-tracing.txt) no oops here.
[6.] A small shell script or example program which triggers the problem (if possible) Config:
[CLIENT eth0]-----[eth0 ROUTER eth1]-----internet
CLIENT eth0: 10.1.1.4/16 SERVER eth0: 10.1.1.1/24 (note the different netmasks!) SERVER eth1: whatever /proc/sys/net/ipv4/ip_forward=1
The session as follows: server # route -Cn | grep 44
CLIENT # ping 10.1.44.44
server # route -Cn |grep 44 10.1.1.4 10.1.44.44 188.8.131.52 i 0 0 2 eth1
The only packet, that arrives to the server is (according to tcpdump) 16:31:46.425917 arp who-has 10.1.44.44 tell 10.1.1.4
[7.] Environment [7.1.] Software (add the output of the ver_linux script here) Fedora Core 3
iproute-2.6.11-1 (the freshest I could get from 'developement' branch), works with older versions too
It's enough, when you leave Packet Socket Unix domain sockets TCP/IP networking (all sub-options off) in the 'networking options'. It must be somewhere in the core networking/routing.
[X.] Other notes, patches, fixes, workarounds: I have recompiled the kernel serveral times with different options. No workaround.
The bug is a big problem, when you have netmask mismatch (well, I have few hundred clients with it and this cannot be fixed easily). A PC infected with a aggresive virus causes hundreds ARP requests per seconds, what in turns leads to routing cache overflows. This doesn't kill the router, but slows it down and there is significant delay, when making a new connection. I would call it 'soft DoS'.
|<Prev in Thread]||Current Thread||[Next in Thread>|
|Previous by Date:||[PATCH 184.108.40.206-bk2] e100: Use EEPROM config for Auto MDI/MDI-X, Eran Mann|
|Next by Date:||Re: [Ksummit-2005-discuss] Summary of 2005 Kernel Summit Proposed Topics, Andi Kleen|
|Previous by Thread:||Problem with compiling Netfilter programs, Akshay Kawale|
|Next by Thread:||[patch netdev-2.6] ixgb: Add MODULE_VERSION, John W. Linville|
|Indexes:||[Date] [Thread] [Top] [All Lists]|