Fascinating behavior from a linux host

Date July 28, 2008

Is this undocumented behavior, or am I missing something obvious?

I am having a very strange issue with one of my Linux hosts.

The primary symptom is that the host responds on two IPs, when ifconfig clearly shows that eth0 is the only interface up (besides the loopback), and only has one IP address.

The arp table on each host that connects to the machine in question shows the same MAC address, regardless of which IP you connect to.

Pinging either IP address from the machine results in responses of such a small amount of time (0.034 ms) that I have no doubt that packets are not leaving the interface.

Running ipconfig -a indicates that eth1 is assigned the alternate IP address that the machine is responding to, however all indications are that the line is down and upon physical examination of the machine, I have verified that there is only one ethernet cable plugged in, and it is going into eth0

At this point, I'm not really sure how to proceed. Obviously I can remove the alternate IP address from eth1, but I'm still at a loss as to why the machine
A) responds positively to an IP address assigned to a down interface
B) sends that request through another, up interface
C) responds with the MAC address of the up interface

I've checked, and there are no iptables rules, there are no specific routing instructions, and neither interface shows up in the arp table of the host in question. All of these are proper conditions for this host.

Any comments or suggestions?

  • goozbach

    Whenever I have issues with my interfaces, I try to get further information.

    Have you tried looking at the interfaces with something other than "ifconfig"?

    I usually try both the ifconfig command and the ip command(part of the iproute2 package).

  • Dan C

    What kind of physical machine is it?

    Does it have any form of self-contained switch or LOM functionality?

  • Matt

    @goozbach

    I don't see anything out of the ordinary there, and it looks like it's reporting the same information as the other commands. I would think that information would all be stored in the kernel, but I'm not certain of how exactly that works

    @DanC

    It's a standard, off the shelf Poweredge 1950. No strange hardware or software at all.

    [root@oh-ops2 ~] cat /etc/issue
    Red Hat Enterprise Linux Server release 5.2 (Tikanga)
    Kernel \r on an \m

    [root@oh-ops2 ~] uname -a
    Linux oh-ops2 2.6.18-92.el5 #1 SMP Tue Apr 29 13:16:15 EDT 2008 x86_64 x86_64 x86_64 GNU/Linux

    Thanks, both of you for looking at the problem and helping. I appreciate it

  • Paul Mohr

    The most logical thing I would guess is that the configuration in BIOS or PCI has a duplicate and it simply uses the same address for both. I would check the BIOS if that is configurable and there are commands dmidecode and hwinfo.

  • Anonymous

    it's not a 169.xxx.xxx.xxx address by any chance? (avahi auto config)

  • Matt

    @Anonymous

    Nope, it's a 10.x.x.x address, specific to this subnet, and not in the dhcp range.

    I'm 99.999% sure it's being caused by having the IP assigned to the down interface, I just haven't figured out which part is confused enough to still think it's up.

    Thanks for the comment though, and if you have any more questions or suggestions, send them through

  • Les

    I have had weird network stuff happen on RHEL5 and have always resolved the problem by deleting an erronous ifcfg-eth0.bak file from /etc/sysconfig/network-scripts/ directory.

  • Gar

    Check out the man page for ifconfig, under "options"

    up This flag causes the interface to be activated. It is implicitly specified if an address is assigned to the interface.

  • Cian

    I've seen this on a few occasions, with up interfaces replying from the wrong physical interface/mac address. No idea what causes it though.

  • Mark

    Have you used "ip addr" to list the address assigned to various interfaces? ifconfig doesn't know about secondary addresses assigned to interfaces.

  • Andrew G

    I assume that ip forwarding is turned off?
    $ cat /proc/sys/net/ipv4/ip_forward

  • Matt

    @andrew_g

    I'm going to go ahead and say Gar got it, but I still don't know why it was forwarding the traffic. No, IP forwarding is off.

    Anyway, I'm going to fix the machine today, so I assume the problem will go away. If not, I'll post a follow-up on the blog.

    Thanks everyone for your input! I really appreciate it.