Home / server / Questions / 128464
Accepted
Charles Stewart
Asked: 2010-04-02 06:02:37 +0800 CST

How to stop my VPS from picking up ARP reqs it is not supposed to?

  • 772

Machine: Xen-3.0 image running stable Debian Linux 2.6.18, pretty vanilla.

My VPS provider asks me to deal with some trouble my image is causing, namely handling IP addresses it is not supposed to:

The problem is that your server seems to be configured to use IPs that have not been appointed to you. Your server responds to ARP requests for the IPs 81.171.111.219 and 81.171.111.218. But you are not allowed to use those.

Not explicitly, as far as I can tell! At least, nothing under /etc or /var/tmp mentions these IP addresses. But arp -v says something I can't make sense of:

Address                  HWtype  HWaddress           Flags Mask            Iface
81.171.111.1             ether   00:0C:DB:E3:80:00   C                     eth0
Entries: 1      Skipped: 0      Found: 1

What is it listening to? The possibilities seem to be:

  1. It's not my fault: my VPS providers have overlooked something. What might that be?
  2. 81.171.111.1 means I'm happy listening in on ARP requests that I shouldn't be: how do I change this? In any case, what does this mean?
  3. I'm looking in completely the wrong place for information on what my image is doing. Where should I be looking?
xen debian arp vps

3 Answers

  1. Check out the arptables package for debian. Possibly could setup static ARP routes. There is little reason for your box to know how to get to other boxes via ARP, you could disable it entirely.

    • 1

  2. Take a look at /etc/rc.local for any static entry.
    Please post the values of :

    sysctl net.ipv4.conf.all|grep arp

    Make sure you get the same results from : 

    arp -na and cat /proc/net/arp

    You may have cache poisoning going on the network. The only way to stop it is to block them at the firewall (they could only allow you to request the gateway with firewall rules). You could also do this on your side.

    Alternatively, I would suggest you to monitor what is going on with Wireshark. http://www.wireshark.org/

    • 0
  3. Best Answer

    The trouble was, as I didn't find out for myself, the ethernet interface was bound to the forbidden IP addresses, although only the gateway address was shown using route/apr/ip route show. ip addr show would have listed the missing addresses; using ip addr del on the two misconfigured ip addresses fixed the problem.

    I should really learn more about Linux networking — this seems like it should have been obvious to me to check. I found Daniel Weiss' Proxy ARP with Linux useful.

    • 0