From owner-freebsd-net@FreeBSD.ORG  Wed Mar 16 19:51:48 2005
Return-Path: <owner-freebsd-net@FreeBSD.ORG>
Delivered-To: freebsd-net@freebsd.org
Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125])
	by hub.freebsd.org (Postfix) with ESMTP id 7BAB616A4CE
	for <freebsd-net@FreeBSD.org>; Wed, 16 Mar 2005 19:51:48 +0000 (GMT)
Received: from mail-relay1.yahoo.com (mail-relay1.yahoo.com [216.145.48.34])
	by mx1.FreeBSD.org (Postfix) with ESMTP id 497E943D1F
	for <freebsd-net@FreeBSD.org>; Wed, 16 Mar 2005 19:51:48 +0000 (GMT)
	(envelope-from gnn@neville-neil.com)
Received: from minion.local.neville-neil.com (proxy7.corp.yahoo.com
	[216.145.48.98])j2GJpUaD067664;	Wed, 16 Mar 2005 11:51:30 -0800 (PST)
Date: Wed, 16 Mar 2005 11:51:31 -0800
Message-ID: <m28y4njrng.wl%gnn@neville-neil.com>
From: "George V. Neville-Neil" <gnn@neville-neil.com>
To: Danny Braniss <danny@cs.huji.ac.il>
In-Reply-To: <E1DBUPh-000EW7-Db@cs1.cs.huji.ac.il>
User-Agent: Wanderlust/2.12.0 (Your Wildest Dreams) SEMI/1.14.6 (Maruoka)
	FLIM/1.14.6 (Marutamachi) APEL/10.6 Emacs/21.3.50 (powerpc-apple-darwin7.7.0)
	MULE/5.0 (SAKAKI)
MIME-Version: 1.0 (generated by SEMI 1.14.6 - "Maruoka")
Content-Type: text/plain; charset=US-ASCII
cc: freebsd-net@FreeBSD.org
cc: ray@redshift.com
Subject: Re: too many Gratuitous ARPs 
X-BeenThere: freebsd-net@freebsd.org
X-Mailman-Version: 2.1.1
Precedence: list
List-Id: Networking and TCP/IP with FreeBSD <freebsd-net.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-net>,
	<mailto:freebsd-net-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/freebsd-net>
List-Post: <mailto:freebsd-net@freebsd.org>
List-Help: <mailto:freebsd-net-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-net>,
	<mailto:freebsd-net-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Wed, 16 Mar 2005 19:51:48 -0000

At Wed, 16 Mar 2005 11:02:01 +0200,
Danny Braniss wrote:
> This is not my case, no kernel messages, I see the packets. (im mirrowing
> the traffic to another host so that i can 'sniff' it).
> 
> the host has indeed two nics, but only one is connected.
> The problem - if indeed it is - only appears on this host, and i have
> several identical ones, that don't show this.
> 

The first thing I would do is look at what is being arped for and then
figure out if there is an application on the machine that you don't
expect to be there.  ARPs happen because the machine wants to talk to
another machine.  So, you need to find out who it wants to talk to
(the IP address) and why (the program that is the source of the
traffic).

Later,
George