topic Re: is it possible to hard code the IP to ARP MAC address in Unix in Operating System - HP-UX

is it possible to hard code the IP to ARP MAC address in Unix

skt_skt — Fri, 23 Oct 2009 11:45:11 GMT

HP-UX 11.11

I see a problem with my arp table and wanted to disable the ARP table update or wanted to manipulate it.

Re: is it possible to hard code the IP to ARP MAC address in Unix

Duncan Edmonstone — Fri, 23 Oct 2009 12:08:59 GMT

sure - see "man arp"

"arp -d " to delete an arp entry

"arp -s " to add an entry

what "problem" do you see with your arp table?

HTH

Duncan

Re: is it possible to hard code the IP to ARP MAC address in Unix

skt_skt — Fri, 23 Oct 2009 12:46:39 GMT

did u check man on 11.11 or 11.23??

Re: is it possible to hard code the IP to ARP MAC address in Unix

skt_skt — Fri, 23 Oct 2009 13:53:47 GMT

worked for 11.11 too

Re: is it possible to hard code the IP to ARP MAC address in Unix

skt_skt — Sun, 25 Oct 2009 09:12:13 GMT

The problem we are seeing the communication failure between two nodes in the same subnet(DMZ zone). While looking the arp table ofen the MAC points to firewall in the subnet which is meant for filtering/controling the traffic to external world(outside the subnet). Since these two machines are suppose to communicate in the layer2(TCP Model)itself w/o an extra hope/router and i feel somehow the traffic is going to the firewall.Or the ARP mapping itself is not working properly which i suppose the switch needs to take care not the hosts.

Re: is it possible to hard code the IP to ARP MAC address in Unix

Matti_Kurkela — Mon, 26 Oct 2009 08:15:10 GMT

The firewall may be using a Proxy-ARP technique to make it look like your servers are in the same subnet, while the reality may be slightly different.

As your server attempts to connect another server within the same segment, it makes an ARP query. If it gets the firewall's MAC address as an answer, that does not happen by accident - something must have been configured to do so.

You said this happens in a DMZ segment? It would be sensible to build the DMZ so that the firewall protects DMZ machines from each other too.

You should talk with your network/firewall administrators to solve your connectivity problem.

The DMZ network segment is probably built so that there is no way for servers within the DMZ to connect each other, and the firewall is using Proxy-ARP technique to make it seem like a normal segment.

If so, an attempt to hard-code the MAC address will just cause all connections to the intended destination server to fail completely. In other words, the network restriction is built in such a way that it's not possible to work around it.

MK

Re: is it possible to hard code the IP to ARP MAC address in Unix

skt_skt — Mon, 26 Oct 2009 09:26:04 GMT

connection between the DMZ was working and noticed it was broke. Also the DMZ servers are used for same application in FT(Fault Tolerant) mode and hence they should be able to talk. So no such restriction in the architecture level. Also note that the connectios works some time(randomly) and falils most of the time. I have hard coded the MAC on both nodes(each other) and will let you know the FT test goes.