Network trivia

Richard B. Johnson (root@analogic.com)
Wed, 5 Mar 1997 18:47:52 -0500 (EST)


Linux chaos 2.1.28 #5 Wed Mar 5 14:20:09 EST 1997 i586

It looks as though EVERYONE on my local segment of the ethernet leg
is now in my ARP cache. I seem to be receiving everyone's packets!

Routing is turned ON during compile, but not enabled. My ethernet sniffer
does not show any duplication of packets, so I am sure that the machine
is not routing anything.

This is the formatted contents of my ARP cache.

archer.analogic.com IP 204.178.41.160 HW 08:00:20:7A:F5:58
system5.analogic.com IP 204.178.40.48 HW 08:00:20:79:7C:C6
as1.analogic.com IP 204.178.40.129 HW 08:00:20:79:87:40
cisco.analogic.com IP 204.178.40.1 HW 00:00:0C:0A:3E:D3
digsparc.analogic.com IP 204.178.40.226 HW 08:00:20:1D:34:2C
analogic.com IP 204.178.40.2 HW 08:00:20:04:D7:B9
boneserver.analogic.com IP 204.178.40.210 HW 08:00:00:85:63:33
asi.analogic.com IP 204.178.40.67 HW 08:00:20:1F:E1:73
gr2.analogic.com IP 204.178.40.164 HW 02:60:8C:AE:83:83
mda-at-1.analogic.com IP 204.178.40.53 HW 08:00:20:7A:E9:C9
spatterson.analogic.com IP 204.178.41.21 HW 00:A0:24:D0:69:40
gate1.analogic.com IP 204.178.40.150 HW 08:00:20:04:DA:43
milo.analogic.com IP 204.178.40.88 HW 08:00:20:1B:02:5F
rgssqa.analogic.com IP 204.178.40.42 HW 08:00:20:76:D7:9E
tapsqa.analogic.com IP 204.178.40.220 HW 00:A0:24:24:38:5A
system2.analogic.com IP 204.178.40.188 HW 08:00:20:75:84:8F
system7.analogic.com IP 204.178.40.124 HW 08:00:20:20:82:9A
blizzard.analogic.com IP 204.178.40.60 HW 08:00:20:78:9E:8D
quark.analogic.com IP 204.178.40.236 HW 08:00:00:30:91:73
cmlai.analogic.com IP 204.178.40.93 HW 08:00:20:76:FA:5A
system6.analogic.com IP 204.178.40.46 HW 08:00:20:75:A3:A4
lasershr.analogic.com IP 204.178.40.238 HW 08:00:20:73:5F:4B
sol24.analogic.com IP 204.178.40.142 HW 08:00:20:04:B7:A1
bmerrifield.analogic.com IP 204.178.41.79 HW 00:A0:24:3C:C5:2E

I don't think that this is good. Device eth0 does not report that it is
in promiscuous mode.

Output from `ifconfig` shows nothing wrong except for the missed field
which accounts for TX packets really being the error-count. Note the
number of packets I have received in about 10 minutes of uptime! I
think I am getting them all, then dumping them on the floor. The only
machine that is "broadcasting" its data is blizzard.analogic.com which
runs NetBois (MicroStuff puts NETBIOS in Broadcast packets).

I really should not be receiving anything but packets transmitted to my
hardware address plus broadcast! The hardware is supposed to filter, not
the network software.

lo Link encap:Local Loopback
inet addr:127.0.0.1 Bcast:127.255.255.255 Mask:255.0.0.0
UP BROADCAST LOOPBACK RUNNING MTU:3584 Metric:1
RX packets:0 errors:97 dropped:0 overruns:0
TX packets:0 errors:0 dropped:97 overruns:0

eth0 Link encap:10Mbps Ethernet HWaddr 08:00:00:12:35:99
inet addr:204.178.40.224 Bcast:204.178.40.255 Mask:255.255.248.0
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:5058913 errors:32629 dropped:0 overruns:0
TX packets:0 errors:233544 dropped:2603 overruns:0
Interrupt:5 Base address:0x300

The output from `route` looks normal, except that "lo" doesn't show
anymore. This hasn't shown for the past few releases. This is probably
just a compatibility problem with my version of `route`.

Kernel routing table
Destination Gateway Genmask Flags MSS Window Use Iface
localnet * 255.255.248.0 U 1500 0 0 eth0
default cisco.analogic. * UG 1500 0 0 eth0

I fear that the ethernet controller is now programmed to receive with
no mask, and sorting through the received junk is now being done in the
kernel. If true, I sure hope it isn't by design! Throwing away 20,000
packets per second in the kernel is sure not going to help performance!

Cheers,
Dick Johnson
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
Richard B. Johnson
Project Engineer
Analogic Corporation
Voice : (508) 977-3000 ext. 3754
Fax : (508) 532-6097
Modem : (508) 977-6870
Ftp : ftp@boneserver.analogic.com
Email : rjohnson@analogic.com, johnson@analogic.com
Penguin : Linux version 2.1.28 on an i586 machine (66.15 BogoMips).
Warning : It's hard to remain at the trailing edge of technology.
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-