Also sprach Richard Mittendorfer <[EMAIL PROTECTED]> (Thu, 18 Aug 2005 01:50:26 +0200): > Also sprach Guido Heumann <[EMAIL PROTECTED]> (Thu, 18 Aug 2005 > 01:08:00 +0200): > > Richard Mittendorfer schrieb: > [...] > > > arpwatch: flip flop 192.168.2.251 0:2:44:16:9c:63 > > > (0:2:44:5b:74:ef) eth1 > > > ^^^^^^^^^^^^^^^eth1 MAC > > > arpwatch: flip flop 192.168.2.251 0:2:44:5b:74:ef > > > (0:2:44:16:9c:63) eth1 > > > ^^^^^^^^^^^^^^^eth0 MAC > > > > > > ..und das innerhalb 5 Minuten. Selbiges auf eth0. Nun koennt es > > > sich um die !$#^rtl8139 handeln oder aber um den arpcache. Ein > > > Vesuch das [...]
Aha! Man lernt ja nie aus... ;) http://linux-ip.net/html/ether-arp.html ---------------------8<-------------------- 2.1.4. The ARP Flux Problem When a linux box is connected to a network segment with multiple network cards, a potential problem with the link layer address to IP address mapping can occur. The machine may respond to ARP requests from both Ethernet interfaces. On the machine creating the ARP request, these multiple answers can cause confusion, or worse yet, non-deterministic population of the ARP cache. Known as ARP flux [13], this can lead to the possibly puzzling effect that an IP migrates non-deterministically through multiple link layer addresses. It's important to understand that ARP flux typically only affects hosts which have multiple physical connections to the same medium or broadcast domain. This is a simple illustration of the problem in a network where a server has two Ethernet adapters connected to the same media segment. They need not have IP addresses in the same IP network for the ARP reply to be generated by each interface. Note the first two replies received in response to the ARP broadcast request. These replies arrive from conflicting link layer addresses in response to this request. Also notice the greater time required for the sending and receiving hosts to process the broadcast ARP request frames than the unicast frames which follow (probes two and three). --------------------8<------------------------ sl ritch -- Haeufig gestellte Fragen und Antworten (FAQ): http://www.de.debian.org/debian-user-german-FAQ/ Zum AUSTRAGEN schicken Sie eine Mail an [EMAIL PROTECTED] mit dem Subject "unsubscribe". Probleme? Mail an [EMAIL PROTECTED] (engl)