[1.] One line summary of the problem:
Bad ARP requests make an entry in routing cache
[2.] Full description of the problem/report:
When there is client/router netmask mismatch (client has wider mask than
the route), ARP request to non-existing local networks make an entry in
routing cache on the router.
Example configuration in [6.]
[3.] Keywords (i.e., modules, networking, kernel):
networking, arp, routing
[4.] Kernel version (from /proc/version):
work also on 2.6.10_rc1_bk17, 2.6.11.
I have not tried earlier versions, because I need some bug-fixes
introduced in 2.6.10_rc1_bk17
[5.] Output of Oops.. message (if applicable) with symbolic information
resolved (see Documentation/oops-tracing.txt)
no oops here.
[6.] A small shell script or example program which triggers the
problem (if possible)
[CLIENT eth0]-----[eth0 ROUTER eth1]-----internet
CLIENT eth0: 10.1.1.4/16
SERVER eth0: 10.1.1.1/24 (note the different netmasks!)
SERVER eth1: whatever
The session as follows:
server # route -Cn | grep 44
CLIENT # ping 10.1.44.44
server # route -Cn |grep 44
10.1.1.4 10.1.44.44 188.8.131.52 i 0 0 2 eth1
The only packet, that arrives to the server is (according to tcpdump)
16:31:46.425917 arp who-has 10.1.44.44 tell 10.1.1.4
[7.1.] Software (add the output of the ver_linux script here)
Fedora Core 3
iproute-2.6.11-1 (the freshest I could get from 'developement' branch),
works with older versions too
It's enough, when you leave
Unix domain sockets
TCP/IP networking (all sub-options off)
in the 'networking options'.
It must be somewhere in the core networking/routing.
[X.] Other notes, patches, fixes, workarounds:
I have recompiled the kernel serveral times with different options.
The bug is a big problem, when you have netmask mismatch (well, I have
few hundred clients with it and this cannot be fixed easily). A PC
infected with a aggresive virus causes hundreds ARP requests per
seconds, what in turns leads to routing cache overflows. This doesn't
kill the router, but slows it down and there is significant delay, when
making a new connection. I would call it 'soft DoS'.