ARP broadcasts from old ip address

Hi,
Several months ago we renumbered and the IP address of my Redhat server
changed. Just recently, I noticed that it is still sending out
hundreds of arp broadcast requests from the old IP address. When I
look at the packets in ethereal, the source IP address is the old IP
address, and the MAC address is of the interface that has the new IP
address.
How do I get these spurious requests to stop?

Thank you,
Pat

Pat wrote:
> Hi,
> Several months ago we renumbered and the IP address of my Redhat server
> changed. Just recently, I noticed that it is still sending out
> hundreds of arp broadcast requests from the old IP address. When I
> look at the packets in ethereal, the source IP address is the old IP
> address, and the MAC address is of the interface that has the new IP
> address.
> How do I get these spurious requests to stop?
>
> Thank you,
> Pat
>

Please show the result of:

ifconfig -a

and

route -n


from the server.

--

Tauno Voipio
tauno voipio (at) iki fi

Tauno Voipio wrote:
> Pat wrote:
> > Hi,
> > Several months ago we renumbered and the IP address of my Redhat
server
> > changed. Just recently, I noticed that it is still sending out
> > hundreds of arp broadcast requests from the old IP address. When I
> > look at the packets in ethereal, the source IP address is the old
IP
> > address, and the MAC address is of the interface that has the new
IP
> > address.
> > How do I get these spurious requests to stop?
> >
> > Thank you,
> > Pat
> >
>
> Please show the result of:
>
> ifconfig -a
>
> and
>
> route -n
>
>
> from the server.

Sorry for the double post earlier, didn't notice that.

Tauno,

ifconfig -a:

eth0 Link encap:Ethernet HWaddr 00:07:E9:06:2F:97
inet addr:10.10.16.2 Bcast:10.10.255.255 Mask:255.255.0.0
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:1052549 errors:0 dropped:0 overruns:0 frame:0
TX packets:175482 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:1000
RX bytes:91502930 (87.2 Mb) TX bytes:12855134 (12.2 Mb)
Interrupt:31 Base address:0x2000 Memory:fe6e0000-fe700000

eth1 Link encap:Ethernet HWaddr 00:07:E9:06:2F:96
inet addr:128.174.xx.25 Bcast:128.174.xx.127
Mask:255.255.255.128
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:41680285 errors:0 dropped:0 overruns:0 frame:0
TX packets:50922375 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:1000
RX bytes:3762374128 (3588.0 Mb) TX bytes:21504012 (20.5 Mb)
Interrupt:30 Base address:0x2040 Memory:fe6c0000-fe6e0000

lo Link encap:Local Loopback
inet addr:127.0.0.1 Mask:255.0.0.0
UP LOOPBACK RUNNING MTU:16436 Metric:1
RX packets:3404733 errors:0 dropped:0 overruns:0 frame:0
TX packets:3404733 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:0
RX bytes:528819711 (504.3 Mb) TX bytes:528819711 (504.3 Mb)


route -n:
Kernel IP routing table
Destination Gateway Genmask Flags Metric Ref Use
Iface
128.174.xx.0 0.0.0.0 255.255.255.128 U 0 0 0
eth1
10.10.0.0 0.0.0.0 255.255.0.0 U 0 0 0
eth0
169.254.0.0 0.0.0.0 255.255.0.0 U 0 0 0
eth1
0.0.0.0 128.174.xx.1 0.0.0.0 UG 0 0 0
eth1


Here is the tethereal capture of the packets from a remote host:

6 5.997983 Intel_06:2f:96 -> Broadcast ARP Who has
131.193.xx.100? Gratuitous ARP
7 8.001704 Intel_06:2f:96 -> Broadcast ARP Who has
131.193.xx.100? Gratuitous ARP
8 10.001055 Intel_06:2f:96 -> Broadcast ARP Who has
131.193.xx.100? Gratuitous ARP
131.193.xx.100 is the old IP address.


Thanks for your help.

Pat wrote:

(parts clipped)

> Tauno,
>
> ifconfig -a:
>
> eth1 Link encap:Ethernet HWaddr 00:07:E9:06:2F:96
> inet addr:128.174.xx.25 Bcast:128.174.xx.127
> Mask:255.255.255.128
> UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
> RX packets:41680285 errors:0 dropped:0 overruns:0 frame:0
> TX packets:50922375 errors:0 dropped:0 overruns:0 carrier:0
> collisions:0 txqueuelen:1000
> RX bytes:3762374128 (3588.0 Mb) TX bytes:21504012 (20.5 Mb)
> Interrupt:30 Base address:0x2040 Memory:fe6c0000-fe6e0000
>
>
> Here is the tethereal capture of the packets from a remote host:
>
> 6 5.997983 Intel_06:2f:96 -> Broadcast ARP Who has
> 131.193.xx.100? Gratuitous ARP
> 7 8.001704 Intel_06:2f:96 -> Broadcast ARP Who has
> 131.193.xx.100? Gratuitous ARP
> 8 10.001055 Intel_06:2f:96 -> Broadcast ARP Who has
> 131.193.xx.100? Gratuitous ARP
> 131.193.xx.100 is the old IP address.
>

If possible, try to get another capture with a hex dump of the
ARP packet contents, so that we could rule out a remote end
trying to find the old IP here.

This seems to prove your diagnosis. The capture seems to come
from eth1 with an attempt to set up the old address on eth1.

A shot into the darkness: Check the ARP cache:

arp -vn -i eth1 -a

It should not play any role, but who knows.

--

Tauno Voipio
tauno voipio (at) iki fi

In article <(E-Mail Removed) .com>, Pat wrote:

>>> Several months ago we renumbered and the IP address of my Redhat server
>>> changed. Just recently, I noticed that it is still sending out
>>> hundreds of arp broadcast requests from the old IP address. When I
>>> look at the packets in ethereal, the source IP address is the old IP
>>> address, and the MAC address is of the interface that has the new IP
>>> address.
>>> How do I get these spurious requests to stop?

>Here is the tethereal capture of the packets from a remote host:
>
>6 5.997983 Intel_06:2f:96 -> Broadcast ARP Who has
>131.193.xx.100? Gratuitous ARP

"Gratuitous ARP" -- I think this address is mine - anyone else using it?

Oh, wonderful. SOMEWHERE on your system, you still have a configuration
file for some application that has the old address. I have _NO_ idea what
it might be. As root:

/bin/grep 131.193.xx.100 /etc/* 2>/dev/null
/bin/grep 131.193.xx.100 /etc/*/* 2>/dev/null
/bin/grep 131.193.xx.100 /etc/*/*/* 2>/dev/null
/bin/grep 131.193.xx.100 /etc/*/*/*/* 2>/dev/null

and so on. If you don't find it that way... well it could be in someone's
home directory I suppose - probably the best way to find that is going to
be '/usr/bin/find / -type f -exec /bin/grep -l 131.193.xx.100 {} \;' but
that could take a while and you may want to redirect the output to a file.

Old guy

Moe Trin wrote:

>>131.193.xx.100?**Gratuitous*ARP
>
> "Gratuitous ARP"**--*I*think*this*address*is*mine*-*anyone*else*using*it?
>

No, I'm not. Feel free to use it. ;-)

In article <V4udnUBEqqvN_ircRVn-(E-Mail Removed)>, James Knott wrote:

>Moe Trin wrote:
>
>>>131.193.xx.100? Gratuitous ARP
>>
>>"Gratuitous ARP" -- I think this address is mine - anyone else using it?
>
>
>No, I'm not. Feel free to use it. ;-)

Well, I would, except that one is a uiuc.edu, and not on my net either.

Thanks anyway!

Old guy