FreeBSD 9 and ARP multicast source address error messages

[David DeSimone]

Alexander Wittig <wittigal at msu.edu> wrote:
>
> Nov 10 12:25:45 bt kernel: in_arp: 03:bf:23:09:44:e4 is multicast
> Nov 10 12:25:45 bt kernel: in_arp: 03:bf:23:09:44:87 is multicast
> [...]
> 
> I'm not an expert on networking, but is this condition of ignoring
> such an ARP packet really a noteworthy event? I.e. is this something
> that should not occur in "normal" operation according to the ARP
> specifications? If this is mostly for kernel developers, maybe it
> should only be enabled in debug kernel builds?

I found this tread enlightening on the subject:

    http://fixunix.com/tcp-ip/66685-arp-reply-containing-multicast-mac-ok.html

In particular the reference to RFC 1812 which states:

    A router MUST not believe any ARP reply that claims that the Link
    Layer address of another host or router is a broadcast or multicast
    address.

This requirement is the reason why multicast ARP replies are
problematic, and why Microsoft's NLB implementation often causes
heartburn within the network.

-- 
David DeSimone == Network Admin == fox at verio.net
  "I don't like spinach, and I'm glad I don't, because if I
   liked it I'd eat it, and I just hate it." -- Clarence Darrow


This email message is intended for the use of the person to whom it has been sent, and may contain information that is confidential or legally protected. If you are not the intended recipient or have received this message in error, you are not authorized to copy, distribute, or otherwise use this message or its attachments. Please notify the sender immediately by return e-mail and permanently delete this message and any attachments. Verio, Inc. makes no warranty that this email is error or virus free.  Thank you.