On 11/02/2010 14:28, James Smallacombe wrote: > If it was caused by a malicious arp command on my server, wouldn't a > reboot have gotten rid of it? Would it also result in a "NO CARRIER" on > the interface? Network did not come back until the Ethernet card was > swapped. > > The bottom line is whether it is possible for a NIC failure to cause the > kernel to register an ARP change.
Yes. Getting 'NO CARRIER' all of a sudden after the NIC has been behaving weirdly looks very much like hardware spiralling into oblivion and not enemy action. Having a corrupted arp cache is also likely a symptom of hardware going bad. NIC failure can have the observed results, and it's quite likely that on reboot the NIC would fail to work entirely in that situation. Actually, one thing it's always a good idea to test in these circumstances is that it's not a broken or loose ethernet cable. This can cause all sorts of similar weirdness, but it's a lot easier and cheaper to fix. I've seen the like sort of problems just from people pulling cable ties too tight. Cheers, Matthew -- Dr Matthew J Seaman MA, D.Phil. 7 Priory Courtyard, Flat 3 Black Earth Consulting Ramsgate Kent, CT11 9PW Free and Open Source Solutions Tel: +44 (0)1843 580647
signature.asc
Description: OpenPGP digital signature