Problem with arp static route

[likid0]

Hy,

I have a strange problem with a hp-ux npar 11.23 IA server.

the thing is, somehow the server is putting a bad static arp entry, for it's hostname that isn't correct, so other machines can't connect with it, this has happend twice in 2 months,dates don't match:

another machine on the network:

pr@root:>ping int
PING sdprinte: 64 byte packets
pr@root:>arp -a | grep -i int
int (10.7.115.132) at 0:50:56:94:5b:71 ether

on int where whe have the problem, we can see thats not his mac adress:
int@root:>lanscan
Hardware Station Crd Hdw Net-Interface NM MAC HP-DLPI DLPI
Path Address In# State NamePPA ID Type Support Mjr#
2/0/2/1/0 0x001A4B06AAC4 0 UP lan0 snap0 1 ETHER Yes 119

When I query the arp table on the int server, I can see there is a static arp entry pointing to the bac mac :=0 , If I put a static root on the server everything works ok:

int@root:>arp -s int 00:1A:4B:06:AA:C4 pub

in another server:

pr@root:>arp -a | grep -i pr
int (10.7.115.132) at 0:1a:4b:6:aa:c4 ether
pr@root:>ping sdprinte
PING int: 64 byte packets
64 bytes from 10.7.115.132: icmp_seq=0. time=0. ms

My questions are, is there a way to audit when a arp static table is added to the server ?

do the permanente static arp entrys go to a file, that i can monitor?

any ideas, what can be adding a bad static arp entry to the server?

any way to monitor it?

[Duncan Edmonstone]

ould this be as simple as a duplicate IP address? Can your network admins not tell you what that other MAC address is for?

HTH

Duncan

[likid0]

Yes, its a windows server, but i has another ip address, and then lan onm the win server has been up for serveral months

[Duncan Edmonstone]

... and have YOU actually seen the full output of:

ipconfig /all

for that Windows server, or are you trusting a Windows admin to give you the right information? (i.e. someone who might look in one place in a GUI rather than the full output...)

HTH

Duncan

[likid0]

Yep, I saw it, they windows admins are in the same building as I am, and it looks like it's configured ok.

[Duncan Edmonstone · Accepted solution]

Then I would look to get a copy of wireshark on both the host in question and another target system on the network (and maybe in the windows host with the matching MAC address as well). HP-UX version is available here:

http://hpux.connect.org.uk/hppd/hpux/Gtk/Applications/wireshark-1.1.0/

Note the long list of runtime dependencies you'll also have to install...

Windows version here:

http://www.wireshark.org/

You can then review the ARP packets as they are sent/received to try and determine the location of the problem...

You might have to tear down and reconfigure the IP stacks on the hosts to get fresh ARPs generated.

HTH

Duncan

[likid0]

Hy,

Yes I installed wireshark, a couple of days ago, but i used the proper internet express depots hp-ux puts out, to forget about the dependencies, it can be downloaded from:

http://h20293.www2.hp.com/portal/swdepot/displayProductInfo.do?productNumber=HPUXIEXP1123

I have been messing around with it.

The thing is, what I really want to know is whem a static arp entry in my local machine has been modified, there is a program arpwatcher that looks great but I am not able to compile it.

[likid0]

I am using:

ndd -get /dev/arp arp_cache_report

monitoring the static roots with a diff


Thnx