Cannot ping host stale ARP cache?

Question

I am having a strange issue with a Debian (Lenny/Linux 2.6.26-2-amd64) that has been driving me nuts. On some machines within my network I can ping the host in question just fine, other times I have to manually hard-code the ARP ethernet address for the IP in order to establish connectivity. I've finally worked it down to somehow involving ARP. I just found how to fix it in a way that made it work but I'm looking for help explaining this issue and also I don't trust my fix to be permanent..

My thought process has been the following but I just can't make any sense out of it:

Could it be the card? (Intel 82555 rev 4)
Could it be because there are two network cards? (Default route is eth0)
Could it be because of the network aliases?
Lenny?
AMD x86_64?
Argh..

Thank you for any insight you might have

// Ping doesn't go thru
[gordon@ubuntu ~]$ ping 192.168.135.101
PING 192.168.135.101 (192.168.135.101) 56(84) bytes of data.

--- 192.168.135.101 ping statistics ---
4 packets transmitted, 0 received, 100% packet loss, time 3014ms

// Here's the ARP Table, sometimes the .151 address is good, sometimes it
// also matches the Gateways MAC like .101 is doing right here.
[gordon@ubuntu ~]$ cat /proc/net/arp
IP address       HW type     Flags       HW address            Mask     Device
192.168.135.15   0x1         0x2         00:0B:DB:2B:24:89     *        eth0
192.168.135.151  0x1         0x2         00:0B:6A:3A:30:A6     *        eth0
192.168.135.1    0x1         0x2         00:1A:A2:2D:2A:04     *        eth0
192.168.135.101  0x1         0x2         00:1A:A2:2D:2A:04     *        eth0

// Drop the bad arp table listing and set it manually based on /sbin/ifconfig
[gordon@ubuntu ~]$ sudo arp -d 192.168.135.101
[gordon@ubuntu ~]$ sudo arp -s 192.168.135.101 00:0B:6A:3A:30:A6

// Ping starts going thru..?!?
[gordon@ubuntu ~]$ ping 192.168.135.101
PING 192.168.135.101 (192.168.135.101) 56(84) bytes of data.
64 bytes from 192.168.135.101: icmp_seq=1 ttl=64 time=15.8 ms
64 bytes from 192.168.135.101: icmp_seq=2 ttl=64 time=15.9 ms
64 bytes from 192.168.135.101: icmp_seq=3 ttl=64 time=16.0 ms
64 bytes from 192.168.135.101: icmp_seq=4 ttl=64 time=15.9 ms

--- 192.168.135.101 ping statistics ---
4 packets transmitted, 4 received, 0% packet loss, time 3012ms
rtt min/avg/max/mdev = 15.836/15.943/16.064/0.121 ms

The following is my network config on this.

gordon@db01:~$ /sbin/ifconfig
eth0      Link encap:Ethernet  HWaddr 00:0b:6a:3a:30:a6
          inet addr:192.168.135.151  Bcast:192.168.135.255  Mask:255.255.255.0
          inet6 addr: fe80::20b:6aff:fe3a:30a6/64 Scope:Link
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:15476725 errors:0 dropped:0 overruns:0 frame:0
          TX packets:10030036 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000
          RX bytes:18565307359 (17.2 GiB)  TX bytes:3412098075 (3.1 GiB)

eth0:0    Link encap:Ethernet  HWaddr 00:0b:6a:3a:30:a6
          inet addr:192.168.135.150  Bcast:192.168.135.255  Mask:255.255.255.0
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1

eth0:1    Link encap:Ethernet  HWaddr 00:0b:6a:3a:30:a6
          inet addr:192.168.135.101  Bcast:192.168.135.255  Mask:255.255.255.0
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1

eth1      Link encap:Ethernet  HWaddr 00:e0:81:2a:6e:d0
          inet addr:10.10.62.1  Bcast:10.10.62.255  Mask:255.255.255.0
          inet6 addr: fe80::2e0:81ff:fe2a:6ed0/64 Scope:Link
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:10233315 errors:0 dropped:0 overruns:0 frame:0
          TX packets:19400286 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000
          RX bytes:1112500658 (1.0 GiB)  TX bytes:27952809020 (26.0 GiB)
          Interrupt:24

lo        Link encap:Local Loopback
          inet addr:127.0.0.1  Mask:255.0.0.0
          inet6 addr: ::1/128 Scope:Host
          UP LOOPBACK RUNNING  MTU:16436  Metric:1
          RX packets:387 errors:0 dropped:0 overruns:0 frame:0
          TX packets:387 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0
          RX bytes:41314 (40.3 KiB)  TX bytes:41314 (40.3 KiB)

gordon@db01:~$ sudo mii-tool -v eth0
eth0: negotiated 100baseTx-FD, link ok
  product info: Intel 82555 rev 4
  basic mode:   autonegotiation enabled
  basic status: autonegotiation complete, link ok
  capabilities: 100baseTx-FD 100baseTx-HD 10baseT-FD 10baseT-HD
  advertising:  100baseTx-FD 100baseTx-HD 10baseT-FD 10baseT-HD flow-control
  link partner: 100baseTx-FD 100baseTx-HD 10baseT-FD 10baseT-HD

gordon@db01:~$ sudo route
Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
localnet        *               255.255.255.0   U     0      0        0 eth0
10.10.62.0      *               255.255.255.0   U     0      0        0 eth1
default         192.168.135.1   0.0.0.0         UG    0      0        0 eth0

Added tags: ethernet, routing, and tcpip. – Warner Mar 12 '10 at 05:22 — Warner, Mar 12 '10 at 05:22

score 2 · Accepted Answer · answered Mar 12 '10 at 05:18

Your gateway, for whatever reason, has 192.168.135.101 bound to it.

I bet if you brought down eth0:1 and the ARP table didn't have an entry for the 192.168.135.101, it will still respond to an ICMP request.

Focus on the machine with the 00:1A:A2:2D:2A:04 address, it's the culprit.

score 0 · Answer 2 · answered Mar 12 '10 at 05:19

I would empty the arp cache and run wireshark as I tried to ping. You will see the ARP request and response. That will probably give you a good idea why your machine's pinging isn't working correctly.

Do you have a network schematic you can show us?

score 0 · Answer 3 · answered Mar 21 '10 at 22:54

For weeks some of my IP addresses could not be pinged outside of BeThere broadband and I believe it was due to the ISP router holding incorrect ARP tables.

This may be due to ARP poisioning attack but to sort the remote ARP table try the following linux command:

arping -I <interface> <IP address>

Cannot ping host stale ARP cache?

3 Answers3