ARP broadcasts

[Mr. R. Astles]

We have noticed that one of our servers is flooding the network with ARP broadcasts.
This is an old server due to be replaced but has to survive at least another 2 months.

The server is both a NFS server and a NIS server.

The ARP requests are to workstations that nolonger exist.

We have removed all references to these workstations from the hosts, nis dns and the rmtab file.


We have noticed that if we disable the NIS master server using SAM the ARP's stop but only to resume again when the service is re-started.

We have executed ypmake but so far nothing we have looked at seem to make any difference and the whole event is having an impact on performance.


Any one any ideas?

[Tom Maloy]

Since the system will be replaced, I would suggest disabling the master server, and making one of the slaves into the new master.

This might also make the server replacement a little less complex.

[rick jones]

Sounds like there is still a file or two with those IP addresses or names in it. It would be a bit brute-force, but you could do :

nice find / -exec grep -l {} \;

and see what file(s) may still remain with the ip address(es) in them.

If you are running 11.0 or later, you could tusc the NIS master server and see what files it is looking-at and see what socket calls are being made using the ipaddresses (has to be a verbose tusc trace).

FWIW, just how many ARPs are we talking about here?

One kludgy thing to do would be to put some dummy ARP entries into the ARP cache with the arp command to satisfy the ARP lookups. This would get-rid of the ARPs, but I do not know if the resulting traffic would be more or less frequent. You could, I suppose use the MAC address of the system itself and at least then it would only be affecting itself and not other systems on the network.

[Bill Thorsteinson]

Check the etc tree with

nice find /etc -type f | xargs nice grep -l "IpAddress"

This will list any config files with the IP address. You may want to use extended grep
to look for multiple addresses and the names.
You may also want to check sbin at the same time.