On Tue, Aug 22, 2006 at 01:25:17PM +0200, Jonathan Schleifer wrote:
> Hi!
>
> Recently I just had a look at netstat -nrf inet and saw an IP not even
> in the network. Two days later I realized it was my friend's PC (he
> visisted me here with his PC) because he had the same IP again on a
> second visit with his PC. But then I wondered why it was still in the
> routing table. After the second visit, the same happened again: He
> wasn't even here anymore and 24h later, the IP was still in the routing
> table.
>
> The problem is only with my friend's box. All other machines here get
> removed from the routing table after they are off for a while. The line
> always remaining in the routing table is this:
>
> 192.168.1.44 link#2 UHLc 1 261582 - rl0
>
> Looking for link#2:
> 192.168.1/24 link#2 UC 4 0 - rl0
>
> That's why I'm wondering: Are there any reasons why a route does NOT
> timeout? Can a machine request to get not removed from the routing
> table in some way? The only thing I know about his machine is that he
> uses Windows XP (*sigh*) without any SP.
More than a *sigh* is in order here. What's he doing on your network,
and where's the cluebat?
> The quoted lines from netstat -nrf inet are from my router, running
> OpenBSD 4.0-beta. I can't test how it is on the other OpenBSD boxes
> here, since none of them runs for 24h or longer.
>
> If you need more information, just tell me what you need.
>
> PS: Removing it manually from the routing table works. But if I don't
> do this, the route doesn't timeout and is kept forever.
There's a reference, so something seems to be holding open a connection
(or at least trying to; this is according to my reading of man netstat |
grep -A3 [Rr]ef). netstat(8) may be useful in finding this connection,
and tcpdrop(8) in dealing with it.
Joachim
