Re: ip_rt_advice

Richard B. Johnson (root@chaos.analogic.com)
Thu, 8 Apr 1999 11:12:41 -0400 (EDT)


On Thu, 8 Apr 1999, Denis Chapligin wrote:

> Здравствуйте
>
> On 8 Apr 1999, Andi Kleen wrote:
>
> > > I have a strange messages at /var/log/debug:
> > > Apr 7 19:25:00 hurricane kernel: ip_rt_advice: redirect to 194.186.140.201/00 dropped
> > > Apr 7 19:25:14 hurricane kernel: ip_rt_advice: redirect to 194.186.140.201/00 dropped
> > >
> > > But this addresses are really exist in my network. During this messages,
> > > machines with this ip are not available. What does this mean?
> >
> > Someone sent you a ICMP redirect for these IPs. The kernel installed
> > a temporary route for it. Because these hosts didn't answer it concludes
> > after some time that the redirect was bad and removes the temporary route.
> > If it bothers you feel free to comment it out, but it would be better to
> > fix the routing so that no ICMP redirect is needed.
> >
> I don't need routing for this machines, because they all are in one
> ehternet segment. So, i can't understand, where the problem with
> routing? May be this is an hacker attack?
> Denis Chapligin
>

Check to see if any of the machines are running the routed daemon. This
is running by default on Sun machines. This causes them to advertise
routes (even though they share the same wire as everybody else). This
results in strange routing-table entries on cooperating machines and
duplicate packets on the physical link.

Physically removing the routed daemon on our Suns (about 15 to 20 of
them), and rebooting dropped the LAN traffic to about 1/10th its
previous. We had Suns routing to Suns which were routing to Suns,
etc., eventually going to somewhere local.

Cheers,
Dick Johnson
***** FILE SYSTEM WAS MODIFIED *****
Penguin : Linux version 2.2.5 on an i686 machine (400.59 BogoMips).
Warning : It's hard to remain at the trailing edge of technology.

-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.rutgers.edu
Please read the FAQ at http://www.tux.org/lkml/