0

My server keeps sending ARP requests and my provider is not happy with this. To find out the reason I would like to block all outgoing arp requests (so that my provider doesn't block my server again) and terminate one by one all processes to find out which one is doing this.

How can I block ALL outgoing ARP traffic (maybe using arptables)?

I am running Debian 7.

EDIT: Output of ip ro sh:

default via 78.xxx.yyy.41 dev eth0
78.xxx.yyy.40/29 via 78.xxx.yyy.41 dev eth0
78.xxx.yyy.40/29 dev eth0 proto kernel scope link src 78.xxx.yyy.46
1

If you block ALL outgoing ARP requests, you won't be able to establish any network connections besides perhaps broadcast stuff.

The problem is perhaps that you're sending unnecessary ARP requests. I have seen this when the default route is simply declared to be the outgoing network interface and not a gateway. This means that the system has to do an ARP for all outgoing IP addresses and that can be a lot if you're serving e.g. a website to the whole world.

The solution in that case was to change the default route to a gateway IP address and not to just an interface name. Now the system only needs to send ARPs for that gateway IP address, which is cached and hence only done at most a couple of times per minute instead of for every unique IP address that connects to your system or your system tries to connect to.

EDIT:

The second line of your ip ro sh output is a (the?) problem; you are routing traffic for your /29 subnet via the gateway router, which presumably sends out ICMP redirects to the real host. You should simply delete that route, as the third line will take care of traffic to hosts within your subnet. Please investigate how that route has been added to your system.

  • The VPS has already a default route. It is the configuration the provider gives and it always worked! – giovi321 Jan 30 '15 at 12:15
  • Show the output of ip ro sh – wurtel Jan 30 '15 at 13:09
  • default via 78.xxx.yyy.41 dev eth0 \ 78.xxx.yyy.40/29 via 78.xxx.yyy.41 dev eth0 \ 78.xxx.yyy.40/29 dev eth0 proto kernel scope link src 78.xxx.yyy.46 – giovi321 Jan 30 '15 at 13:53
  • " \ " indicates a new line. xxx and yyy in ip address means that they are the same numbers. – giovi321 Jan 30 '15 at 13:56
  • It's usual to add extra info to the question; I've done that for you and edited my answer in response to the extra info. – wurtel Jan 30 '15 at 14:58

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.