From owner-freebsd-net@FreeBSD.ORG  Thu Mar 17 07:15:38 2005
Return-Path: <owner-freebsd-net@FreeBSD.ORG>
Delivered-To: freebsd-net@freebsd.org
Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125])
	by hub.freebsd.org (Postfix) with ESMTP id B8AEB16A4CE
	for <freebsd-net@FreeBSD.org>; Thu, 17 Mar 2005 07:15:38 +0000 (GMT)
Received: from cs1.cs.huji.ac.il (cs1.cs.huji.ac.il [132.65.16.10])
	by mx1.FreeBSD.org (Postfix) with ESMTP id 5830E43D46
	for <freebsd-net@FreeBSD.org>; Thu, 17 Mar 2005 07:15:38 +0000 (GMT)
	(envelope-from danny@cs.huji.ac.il)
Received: from pampa.cs.huji.ac.il ([132.65.80.32])
	by cs1.cs.huji.ac.il with esmtp
	id 1DBpEH-000Pto-1P; Thu, 17 Mar 2005 09:15:37 +0200
X-Mailer: exmh version 2.7.0 06/18/2004 with nmh-1.0.4
To: "George V. Neville-Neil" <gnn@neville-neil.com>
In-Reply-To: Message from "George V. Neville-Neil" <gnn@neville-neil.com> 
   of "Wed, 16 Mar 2005 11:51:31 PST." <m28y4njrng.wl%gnn@neville-neil.com> 
Mime-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Date: Thu, 17 Mar 2005 09:15:36 +0200
From: Danny Braniss <danny@cs.huji.ac.il>
Message-ID: <E1DBpEH-000Pto-1P@cs1.cs.huji.ac.il>
cc: freebsd-net@FreeBSD.org
cc: ray@redshift.com
Subject: Re: too many Gratuitous ARPs 
X-BeenThere: freebsd-net@freebsd.org
X-Mailman-Version: 2.1.1
Precedence: list
List-Id: Networking and TCP/IP with FreeBSD <freebsd-net.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-net>,
	<mailto:freebsd-net-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/freebsd-net>
List-Post: <mailto:freebsd-net@freebsd.org>
List-Help: <mailto:freebsd-net-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-net>,
	<mailto:freebsd-net-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Thu, 17 Mar 2005 07:15:38 -0000

> At Wed, 16 Mar 2005 11:02:01 +0200,
> Danny Braniss wrote:
> > This is not my case, no kernel messages, I see the packets. (im mirrowing
> > the traffic to another host so that i can 'sniff' it).
> > 
> > the host has indeed two nics, but only one is connected.
> > The problem - if indeed it is - only appears on this host, and i have
> > several identical ones, that don't show this.
> > 
> 
> The first thing I would do is look at what is being arped for and then
> figure out if there is an application on the machine that you don't
> expect to be there.  ARPs happen because the machine wants to talk to
> another machine.  So, you need to find out who it wants to talk to
> (the IP address) and why (the program that is the source of the
> traffic).

The 'Gratuitous ARPs' where being generated by the IPMI/BMC. The net stack
in the BMC does not implement ARP, so to keep others happy, it's sending out
'Gratuitous ARP', the good news is that the time can be configured, so that's
what we did.

thanks,
	danny