Strange Network behavior

Richard B. Johnson (
Fri, 25 Jul 1997 22:59:40 -0400 (EDT)

Thanks to many of you, I now have the firewall running on my PPP server.
It gets rid of the Micro$oft garbage from WIN-NT and WIN-95 beasties.

While experimenting, I noticed something that I don't understand --err
well there are a lot of things I don't understand, but this one bothers
me a bit.

If I kill all the deamons `kill -9 -1`, I would expect that the Linux
machine would be a quiet machine on the network. Not so. It periodically
does an ARP for,, 42.255, etc. The network
address is, netmask is Why would it be
ARPing a broadcast address? In principle, with a netmask of,
the broadcast address should be, but many machines use
the broadcast address of each 'C' subnet, i.e., 40.255, 41.255, 42.255, etc.

Why would a Linux machine with no `known` network activity even care about
ARPing these addresses? It seems real strange. The ARP cache contains
these addresses, put there I think, when the machine was configured for
routing and transparent proxy: IP HW 00:00:0C:0A:3E:D3 IP HW 08:00:00:85:63:33
unknown host IP HW 00:00:00:00:00:00 IP HW 00:00:00:00:00:00
unknown host IP HW 00:00:00:00:00:00 IP HW 08:00:00:30:91:73
unknown host IP HW 00:00:00:00:00:00

I do not use the routed daemon. Only static routes are configured.

I think that these addresses are being `expired` and the network
code attempts to `refresh` them by sending the ARP who-is message
on the LAN. If so, this might be a tiny bug.

Richard B. Johnson
Analogic Corporation
Penguin : Linux version 2.1.44 on an i586 machine (66.15 BogoMips).
Warning : It's hard to stay on the trailing edge of technology.
Linux : Engineering tool
Windows : Typewriter