[nSLUG] Getting CPU cycles during an ARP storm

Donald Teed donald.teed at gmail.com
Tue Sep 20 12:57:00 ADT 2005


I learned a little more about why the traffic was very high in the real 
world
case and lower in my test at home. In a LAN with a few hundred users,
a storm of random ARP packets would saturate the network, but it also
has a side effect of causing other clients to resend any of their legitimate
broadcast packets. The traffic density spirals upward.

On 9/20/05, Bill Davidson <bdavidso at supercity.ns.ca> wrote:
> 
> Hi:
> 
> On Sun, 2005-18-09 at 17:55 -0400, Stephen Gregory wrote:
> 
> > ...Arp should also be handled by the network card. And should not slow
> > down the system. The only way an arp storm would impact the cpu is the
> > network card was in promiscuous mode.
> >
> 
> Aren't arp requests always broadcasts? If a host says "who has w.x.y.z"
> it needs to ask everybody. So a card should not need to be in
> promiscuous mode to receive arp requests. And while I'm sure some newer
> NIC's (especially I2O) may implement arp in firmware, for most
> implementations I think it is in the kernel
> (see /usr/src/linux/net/ipv4/arp.c). It belongs there, because most NIC
> drivers neither know nor care about TCP/IP.
> 
> 
> --
> Bill Davidson
> bdavidso at supercity.ns.ca
> 
> 
> 
> _______________________________________________
> nSLUG mailing list
> nSLUG at nslug.ns.ca
> http://nslug.ns.ca/cgi-bin/mailman/listinfo/nslug
> 
> 
> 
>


!DSPAM:4330314d102952146812735!
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://nslug.ns.ca/mailman/private/nslug/attachments/20050920/59a597f7/attachment-0001.html>


More information about the nSLUG mailing list