Red Hat Bugzilla – Bug 63642
Broadcasts from 0.0.0.0 on network restart
Last modified: 2015-03-04 20:10:29 EST
Description of Problem: At bootup or when the network service is restarted, a Red Hat 7.2 machine will send two odd ARP broadcasts: #tcpdump -n host 0.0.0.0 12:37:59.471033 eth0 B arp who-has 129.7.128.137 (Broadcast) tell 0.0.0.0 12:38:00.461030 eth0 B arp who-has 129.7.128.137 (Broadcast) tell 0.0.0.0 These are not DHCP traffic; the machine has a fixed IP address (129.7.128.137) and obviously knows it at this point. Version-Release number of selected component (if applicable): Red Hat Linux 7.2 with updates, iputils 20001110-6, initscripts 6.43-1 Normally I wouldn't care about two packets, but besides the fact that they're unnecessary, I also run arpwatch and am now (after rolling out RH 7.2) being constantly bugged about 0.0.0.0 changing its hardware address. Red Hat 7.1 and earlier did not do this. The current betas also have this issue. How Reproducible: trivially reproduced Steps to Reproduce: 1. run tcpdump host 0.0.0.0 somewhere else on the local network 2. service network restart
It has been suggested that these are an attempt to detect whether the IP address is already in use and to avoid bringing up the interface if so. I can't find this documented anywhere, but if it is intended, then I'll file a bug against arpwatch for bugging me when this happens.
I'll check maybe with our kernel folks as well if this is intentional. If so, reasigning this bug to arpwatch is probably a good idea. Read ya, Phil
OK, I found that this comes from the following lines in /sbin/ifup: if ! arping -q -c 2 -w 3 -D -I ${DEVICE} ${IPADDR} ; then echo $"Error, some other host already uses address ${IPADDR}." exit 1 fi Also, upgrading arpwatch to 2.1a11-10.7x stopped the annoying notices. (I was at 2.1a4-29 from 7.0.) So if bugzilla will let me, I'll resolve this myself. I apologize for wasting your time.