March 8, 20179 yr One of my servers has started flooding my separate pfsense router with what appears to be arp spam? The server seems to be switching back and forth between 2 of the 4 ethernet ports shown by their mac addresses: Mar 8 01:12:37 kernel arp: 192.168.1.121 moved from 00:26:55:2a:2b:ea to 00:26:55:2a:2b:e4 on re0 Mar 8 01:12:40 kernel arp: 192.168.1.121 moved from 00:26:55:2a:2b:e4 to 00:26:55:2a:2b:ea on re0 Mar 8 01:13:17 kernel arp: 192.168.1.121 moved from 00:26:55:2a:2b:ea to 00:26:55:2a:2b:e4 on re0 Mar 8 01:13:20 kernel arp: 192.168.1.121 moved from 00:26:55:2a:2b:e4 to 00:26:55:2a:2b:ea on re0 Mar 8 01:13:58 kernel arp: 192.168.1.121 moved from 00:26:55:2a:2b:ea to 00:26:55:2a:2b:e4 on re0 Mar 8 01:14:00 kernel arp: 192.168.1.121 moved from 00:26:55:2a:2b:e4 to 00:26:55:2a:2b:ea on re0 Mar 8 01:14:27 kernel arp: 192.168.1.121 moved from 00:26:55:2a:2b:ea to 00:26:55:2a:2b:e4 on re0 Mar 8 01:14:30 kernel arp: 192.168.1.121 moved from 00:26:55:2a:2b:e4 to 00:26:55:2a:2b:ea on re0 Mar 8 01:14:58 kernel arp: 192.168.1.121 moved from 00:26:55:2a:2b:ea to 00:26:55:2a:2b:e4 on re0 Mar 8 01:15:00 kernel arp: 192.168.1.121 moved from 00:26:55:2a:2b:e4 to 00:26:55:2a:2b:ea on re0 Mar 8 01:15:27 kernel arp: 192.168.1.121 moved from 00:26:55:2a:2b:ea to 00:26:55:2a:2b:e4 on re0 Mar 8 01:15:30 kernel arp: 192.168.1.121 moved from 00:26:55:2a:2b:e4 to 00:26:55:2a:2b:ea on re0 Mar 8 01:15:57 kernel arp: 192.168.1.121 moved from 00:26:55:2a:2b:ea to 00:26:55:2a:2b:e4 on re0 Mar 8 01:16:00 kernel arp: 192.168.1.121 moved from 00:26:55:2a:2b:e4 to 00:26:55:2a:2b:ea on re0 Mar 8 01:16:28 kernel arp: 192.168.1.121 moved from 00:26:55:2a:2b:ea to 00:26:55:2a:2b:e4 on re0 Mar 8 01:16:29 kernel arp: 192.168.1.121 moved from 00:26:55:2a:2b:e4 to 00:26:55:2a:2b:ea on re0 Mar 8 01:16:58 kernel arp: 192.168.1.121 moved from 00:26:55:2a:2b:ea to 00:26:55:2a:2b:e4 on re0 Mar 8 01:16:59 kernel arp: 192.168.1.121 moved from 00:26:55:2a:2b:e4 to 00:26:55:2a:2b:ea on re0 Mar 8 01:17:27 kernel arp: 192.168.1.121 moved from 00:26:55:2a:2b:ea to 00:26:55:2a:2b:e4 on re0 Mar 8 01:17:29 kernel arp: 192.168.1.121 moved from 00:26:55:2a:2b:e4 to 00:26:55:2a:2b:ea on re0 Mar 8 01:17:57 kernel arp: 192.168.1.121 moved from 00:26:55:2a:2b:ea to 00:26:55:2a:2b:e4 on re0 Mar 8 01:17:59 kernel arp: 192.168.1.121 moved from 00:26:55:2a:2b:e4 to 00:26:55:2a:2b:ea on re0 Mar 8 01:18:27 kernel arp: 192.168.1.121 moved from 00:26:55:2a:2b:ea to 00:26:55:2a:2b:e4 on re0 Mar 8 01:18:29 kernel arp: 192.168.1.121 moved from 00:26:55:2a:2b:e4 to 00:26:55:2a:2b:ea on re0 Mar 8 01:18:57 kernel arp: 192.168.1.121 moved from 00:26:55:2a:2b:ea to 00:26:55:2a:2b:e4 on re0 Mar 8 01:19:00 kernel arp: 192.168.1.121 moved from 00:26:55:2a:2b:e4 to 00:26:55:2a:2b:ea on re0 Mar 8 01:19:31 kernel arp: 192.168.1.121 moved from 00:26:55:2a:2b:ea to 00:26:55:2a:2b:e4 on re0 Mar 8 01:19:35 kernel arp: 192.168.1.121 moved from 00:26:55:2a:2b:e4 to 00:26:55:2a:2b:ea on re0 Mar 8 01:20:01 kernel arp: 192.168.1.121 moved from 00:26:55:2a:2b:ea to 00:26:55:2a:2b:e4 on re0 Mar 8 01:20:03 kernel arp: 192.168.1.121 moved from 00:26:55:2a:2b:e4 to 00:26:55:2a:2b:ea on re0 Mar 8 01:20:31 kernel arp: 192.168.1.121 moved from 00:26:55:2a:2b:ea to 00:26:55:2a:2b:e4 on re0 Mar 8 01:20:33 kernel arp: 192.168.1.121 moved from 00:26:55:2a:2b:e4 to 00:26:55:2a:2b:ea on re0 Mar 8 01:21:00 kernel arp: 192.168.1.121 moved from 00:26:55:2a:2b:ea to 00:26:55:2a:2b:e4 on re0 Mar 8 01:21:03 kernel arp: 192.168.1.121 moved from 00:26:55:2a:2b:e4 to 00:26:55:2a:2b:ea on re0 Mar 8 01:21:31 kernel arp: 192.168.1.121 moved from 00:26:55:2a:2b:ea to 00:26:55:2a:2b:e4 on re0 Mar 8 01:21:33 kernel arp: 192.168.1.121 moved from 00:26:55:2a:2b:e4 to 00:26:55:2a:2b:ea on re0 Mar 8 01:22:01 kernel arp: 192.168.1.121 moved from 00:26:55:2a:2b:ea to 00:26:55:2a:2b:e4 on re0 Mar 8 01:22:04 kernel arp: 192.168.1.121 moved from 00:26:55:2a:2b:e4 to 00:26:55:2a:2b:ea on re0 Mar 8 01:22:31 kernel arp: 192.168.1.121 moved from 00:26:55:2a:2b:ea to 00:26:55:2a:2b:e4 on re0 Mar 8 01:22:35 kernel arp: 192.168.1.121 moved from 00:26:55:2a:2b:e4 to 00:26:55:2a:2b:ea on re0 Mar 8 01:23:01 kernel arp: 192.168.1.121 moved from 00:26:55:2a:2b:ea to 00:26:55:2a:2b:e4 on re0 Mar 8 01:23:04 kernel arp: 192.168.1.121 moved from 00:26:55:2a:2b:e4 to 00:26:55:2a:2b:ea on re0 Mar 8 01:23:31 kernel arp: 192.168.1.121 moved from 00:26:55:2a:2b:ea to 00:26:55:2a:2b:e4 on re0 Mar 8 01:23:33 kernel arp: 192.168.1.121 moved from 00:26:55:2a:2b:e4 to 00:26:55:2a:2b:ea on re0 Mar 8 01:24:46 kernel arp: 192.168.1.121 moved from 00:26:55:2a:2b:ea to 00:26:55:2a:2b:e4 on re0 Mar 8 01:24:50 kernel arp: 192.168.1.121 moved from 00:26:55:2a:2b:e4 to 00:26:55:2a:2b:ea on re0 Mar 8 01:25:37 kernel arp: 192.168.1.121 moved from 00:26:55:2a:2b:ea to 00:26:55:2a:2b:e4 on re0 Mar 8 01:25:39 kernel arp: 192.168.1.121 moved from 00:26:55:2a:2b:e4 to 00:26:55:2a:2b:ea on re0 Mar 8 01:26:27 kernel arp: 192.168.1.121 moved from 00:26:55:2a:2b:ea to 00:26:55:2a:2b:e4 on re0 Mar 8 01:26:29 kernel arp: 192.168.1.121 moved from 00:26:55:2a:2b:e4 to 00:26:55:2a:2b:ea on re0 I have one of my other identical servers which is powered on at the same time does no exhibit this behavior. Both are set for balance-alb. Thoughts?
March 8, 20179 yr I'm guessing the bond is flapping: But maybe the kernel is not logging it? From the bonding documnentation about balance-alb Quote When a link is reconnected or a new slave joins the bond the receive traffic is redistributed among all active slaves in the bond by initiating ARP Replies with the selected MAC address to each of the clients. The updelay parameter (detailed below) must be set to a value equal or greater than the switch's forwarding delay so that the ARP Replies sent to the peers will not be blocked by the switch.
March 8, 20179 yr Author when I take the one of the two ports it is alternating between down, it stops the arp messages for a while, but eventually starts the same activity on another port. I'm going to try switching the bonding mode and see if that changes it. still curious why it happens on 1 server but not the other.
March 8, 20179 yr Author since changing to active backup, arp spam has stopped, but i'm not able to exceed more than 1gb throughput now.... guess it's time to just buy a 10gbe switch and move on.
Archived
This topic is now archived and is closed to further replies.