Mike Lovell wrote:
There are a total of 4 machines that I have seen this problem on. They
are in different broadcast domains and completely different
datacenters. 3 are running Linux but I messed with those a while ago
and I haven't seen the problem lately on them. Or at least no one has
complained. :)
The one that is causing problems is the one Windows box. I installed
Wireshark on it and started watching the interface for ARP packets.
When the machine was unresponsive from other machines, I tried
arping'ing it and there were no ARP packets seen on the interface. I
opened firefox and it went to is default home page. When I did this, I
saw the ARP packets that were generated by the box and the responses
from the network. So what it is looking like is that the network is
not sending the ARP 'Who Has' broadcast packets down the link to this
box. I'll need to bug the net admins about this. The network is pretty
much all Cisco catalyst gear. I don't have the ability to get into the
switches and routers to see what traffic is going across the links.
But I will get someone to look at that.
So I finally got a solution to this problem and figured I would share
with the list. The problem ended up being a driver issue. For some
reason, the driver for the nics was filtering arp broadcast packets
before they made it up the stack. I tried Debian Etch for 32 and 64 bit.
On both, when using the stock 2.6.18 kernel, tcpdump didn't show any arp
packets making it to the system. I had the network admin check the
packets going across the port and the arps were there. Upgrading to
2.6.24 or 2.6.26 fixed the problem and tcpdump started showing arp
requests and responses going across the interface. I had this problem in
Windows as well on XP. But even weirder here. The drivers for the 32
versions of Windows didn't have this problem. But the 64 bit versions
did. So I guess the 64 bit drivers haven't fixed the problem.
Probably useless info for most of you. But hopefully I can save someone
the trouble in the future.
Mike
/*
PLUG: http://plug.org, #utah on irc.freenode.net
Unsubscribe: http://plug.org/mailman/options/plug
Don't fear the penguin.
*/
