From owner-freebsd-hackers@FreeBSD.ORG Thu Mar 18 07:32:36 2004 Return-Path: Delivered-To: freebsd-hackers@freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id 5C3B716A4CF for ; Thu, 18 Mar 2004 07:32:36 -0800 (PST) Received: from dan.emsphone.com (dan.emsphone.com [199.67.51.101]) by mx1.FreeBSD.org (Postfix) with ESMTP id 07A7743D3F for ; Thu, 18 Mar 2004 07:32:36 -0800 (PST) (envelope-from dan@dan.emsphone.com) Received: (from dan@localhost) by dan.emsphone.com (8.12.10/8.12.10) id i2IFWZY9087418 for freebsd-hackers@freebsd.org; Thu, 18 Mar 2004 09:32:35 -0600 (CST) (envelope-from dan) Date: Thu, 18 Mar 2004 09:32:35 -0600 From: Dan Nelson To: FreeBSD Hackers Message-ID: <20040318153234.GB99558@dan.emsphone.com> References: <20040318142924.GA6224@deathstar.warpten.net> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <20040318142924.GA6224@deathstar.warpten.net> X-OS: FreeBSD 5.2-CURRENT X-message-flag: Outlook Error User-Agent: Mutt/1.5.6i Subject: Re: Duplicate ICMP messages X-BeenThere: freebsd-hackers@freebsd.org X-Mailman-Version: 2.1.1 Precedence: list List-Id: Technical Discussions relating to FreeBSD List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 18 Mar 2004 15:32:36 -0000 In the last episode (Mar 18), Nigel Houghton said: > I have a FreeBSD 4.9 box with three network interfaces setup as follows: > > fxp0 - 172.16.20.2 > fxp1 - 192.168.1.2 > bge0 - promiscuous mode, no-arp > > fxp0 is connected to a netgear switch, fxp1 is connected to a Cisco > 2900xl and bge0 is also connected to the Cisco but is listening on a > span port to everything transmitted on the 192.168.1.0/24 subnet. > > Here's the weirdness, when sending an ICMP Echo request to fxp1 from > the switch at 192.168.1.254 duplicate replies are seen coming back. > The same thing happens when sending the same requests from fxp1 to > any other address on the subnet. When the bge0 interface is brought > down the issue goes away and everything is normal. > > systat shows the requests going out and the same number of replies > coming back in. ipfw is being used to deny all icmp via bge0. You can run tcpdump -e to see the MAC addresses of the cards sending both ICMP messages. That will at least let you verify if the 2nd echo is coming out of bge0. Is bge0 configured with any IP addresses? I've got a similar 4.9 setup with 4 monitoring interfaces and haven't ever seen those cards send anything, or seen dupes sent from the regular nic. -- Dan Nelson dnelson@allantgroup.com