Switches, Hubs, and Modems
cancel
Showing results for 
Search instead for 
Did you mean: 

Procurve replies whatever the destination MAC address is

Gilles F
Occasional Visitor

Procurve replies whatever the destination MAC address is

I came across this issue because I needed to ping a procurve vlan ip address for monitoring purpose. Doing so, I noticed I received duplicate replies.
My network has the particularity to have multiple IP subnets on the same Ethernet segment. I know this is not a good practice but I found it in this state and I can’t change it immediately. The station from which I am sending ping requests and the Procurve are not in the same IP subnet, but reachability is possible thanks to a IP router. Here is a schema:

Router====Procurve====Workstation

After doing a few test I understood the Procurve replies to all ping requests provided the destination IP is its IP and whatever the destination Ethernet address is. I made a test by forging an ICMP echo requests from the workstation to a non existing Ethernet address and I get a reply!

ICMP echo request forging (192.168.33.245 is my workstation, 192.168.34.248 is my procurve, 00:00:01:ff:ff:fe is a non existant MAC):
nemesis icmp -vv -i 8 -c 0 -S 192.168.33.245 -D 192.168.34.248 -M 00:00:01:ff:ff:fe -d eth1

Network monitoring result (00:17:9a:b4:94:e7 is my router's MAC):
tcpdump -i eth1 -pn -vvv -e icmp and host 192.168.34.248
tcpdump: listening on eth1, link-type EN10MB (Ethernet), capture size 96 bytes

18:36:15.365266 00:17:9a:b4:94:e7 > 00:00:01:ff:ff:fe, ethertype IPv4 (0x0800), length 42: (tos 0x0, ttl 255, id 58520, offset 0, flags [none], proto: ICMP (1), length: 28) 192.168.33.245 > 192.168.34.248: ICMP echo request, id 43851, seq 29470, length 8

18:36:15.366030 00:13:c3:34:5b:c6 > 00:17:9a:b4:94:e7, ethertype IPv4 (0x0800), length 60: (tos 0x0, ttl 63, id 7569, offset 0, flags [none], proto: ICMP (1), length: 28) 192.168.34.248 > 192.168.33.245: ICMP echo reply, id 43851, seq 29470, length 8

This behavior is quite embarrassing as every communications between the workstation and the Procurve get duplicate reply (ping, telnet, snmp, etc.). Is it a normal behavior, a bug?

My procurve is a J4904A with Firmware revision I.08.58. I know there are recent updates but I didn’t found anything in the release notes dealing with this. Does this strange behavior has been corrected in new firmware version?

Any information will be appreciated.
1 REPLY
Marco Wessel
Valued Contributor

Re: Procurve replies whatever the destination MAC address is

I'm not entirely sure this is a problem with your 2848, but more so with the Cisco router between you and it. It's listening to MACs that it shouldn't be listening to and then forwarding the packets the way it always does (as it is a router, after all.) So by the time these packets get to your 2848, the MAC address you set to 00:00:01:ff:ff:fe will have been scrubbed and replaced with the device's MAC address as ARPed for by the cisco.