HP UX system sending ARP request to a failed windows domain controller

[rick jones]

Anything trying to send to a given IP address has the potential to cause ARP requests to be emitted to map that IP address to a MAC address. At least for an IP address that is in the same subnet(s) as "this" machine.

What could be trying to send to a given IP address? Just about any process on this machine. It could also be from the stack - say if this system wanted to send an ICMP message back to that given IP.

In this case though, based on what the author has said, it sounds like the IP address in question is no longer active, so inbound traffic from that IP address is unlikely, so it is unlikely that this system is trying to send an ICMP to the given IP address.

If one wants to see what sort of traffic a process is attempting to send to this inactive IP address, I would suggest using the arp command to stick a static mapping for that IP address to a "bogus" MAC address. That will allow the traffic to leave the system, which means one can sniff it with say tcpdump running on the system.

Presumably, if someone knew enough about nettl, one could trace at the IP level to get the traffic to that destination IP. I've never really learned how to use nettl/netfmt.

So, something like:

arp -s 01:02:03:04:05

and then:

tcpdump -i host

In that way one can see traffic and see if it is say UDP traffic to port 53 (eg DNS) or something else.

[Horia Chirculescu]

Hello,

You should reboot also the HP-UX system. While this system is down, re-check for ARP requests originated from the same IP address that your HP-UX system have.

Maybe there is some kind of attack (started let's say by some clever viruses) against your DNS server.

Check first your Win* stations/servers that you might have on the same network.

Best regards
Horia.

[Deep Spring]

When HP support looked into the case, they did restart a whole bunch of processes. I believe when the support tried and tested everything up their sleeves, they decided to open up a second telnet service. That has been working for us.

In the meantime, I have used nettl to generate a network trace on the hp ux system and also wireshark on the windows to capture the packets simultaneously. HP support is researching the case based on the captures.

I will surely update you guys if they find anything on this.

Thank you all for your responses!

[Johnson Punniyalingam]

Hope Its "ARP" Settings , anyway let wait