Solaris 10 invalid ARP requests from 0.0.0.0? Link up/down every hour or 2
- by JWD
The guys at the data center where I'm hosting a server running Solaris 10 are telling me that my server is making a lot of invalid arp requests. This is an example of a portion of what was sent to me from the logs (with Mac addresses and IP addresses changed).
[mymacaddress]/0.0.0.0/0000.0000.0000/[myipaddress]/[Datestamp])
It's being logged every hour.
I don't see anything in the arp tables (arp -a) or routing tables (netstat -r) and I don't see anything relating to 0.0.0.0 when snoping the arp requests.
The only place I see any reference to 0.0.0.0 is if I do netstat -a for the SCTP
SCTP:
Local Address Remote Address Swind Send-Q Rwind Recv-Q StrsI/O State
------------------------------- ------------------------------- ------ ------ ------ ------ ------- -----------
0.0.0.0 0.0.0.0 0 0 102400 0 32/32 CLOSED
But not really sure what that means. Doesn't seem like I can disable SCTP. There are some tunable SCTP parameters but it's not something I'm familiar with. Do I have to add changes to /etc/system? Looks like sctp_heartbeat_interval might be what I need to change?
If it makes any difference, I have a few solaris zones running on this server, each with their own IP address on a virtual interface. eth0:0, eth0:1, etc.
Does anyone have any idea what might be causing this and how to stop it? I think the switch I'm connected to doesn't like it and momentarily drops the connection.
Is there anyway to at least block those requests using ipfilter or something else?
Update: This was happening more frequently but now it seems to be happening roughly every hour or every two hours. It's not consistent. I tried setting setting the link speed and duplex to match the switch port and that seemed to make it stop happening for a few hours but then it started again.
