Path: utzoo!utgpu!news-server.csri.toronto.edu!mailrus!cs.utexas.edu!yale!cmcl2!phri!news From: roy@alanine.phri.nyu.edu (Roy Smith) Newsgroups: comp.protocols.tcp-ip Subject: Why does a wrong broadcast address cause arp-havoc? Message-ID: <1990Jul13.205833.7161@phri.nyu.edu> Date: 13 Jul 90 20:58:33 GMT Sender: news@phri.nyu.edu (News System) Organization: Public Health Research Institute, New York City Lines: 28 By watching with tcpdump, I can see that when an occassional IP object gets configured with the wrong broadcast address, each time it sends a broadcast packet, a flurry of arp requests are generated by various machines on the network. I sort of understand what is going on, but not exactly. We use a hostpart of .0.0 for broadcasts, but once in a while a misconfigured box pops up with .255.255, which other machines then try to arp for. What I don't understand is 1) why they bother to arp at all and 2) why only some machines do it? As I understand it, when a machine wants to send an IP packet, it has to arp to find out what link-level address to put in the ethernet dst field. But why should a machine try to do an IP->ether address resolution just because it receives an rwho packet sent to the wrong IP broadcast address? An rwho requires no response, so there really isn't any reason to need to know where it came from. As for the second question, what is it about some machines that makes them arp for bad broadcasts and others not? In our particular case, we have a bunch of Sun-3's, all running SunOS-3.5.2. One of them runs a generic kernel, and that's the only one that arps in response to .255.255 packets. All our other Suns run customized kernels, but the only customizations are to delete device drivers they don't need; nothing (that I know of) has been changed in the networking code, yet they don't arp .255.255's. Why not? -- Roy Smith, Public Health Research Institute 455 First Avenue, New York, NY 10016 roy@alanine.phri.nyu.edu -OR- {att,cmcl2,rutgers,hombre}!phri!roy "Arcane? Did you say arcane? It wouldn't be Unix if it wasn't arcane!"