AIR Wiki: Link-Local ARP Measurements

Link-Local ARP Measurements

RFC 3927∞ (IPv4 Link-Local Adressing) specifies that not just ARP requests, but also ARP replies must be broadcasted. This helps in identifying duplicate IP addresses, which is particularly usefull in LAN which use link-local IP addresses (169.254/16). These test are meant to measure normal ARP behaviour, identify when that normal behaviour is indeed a problem, and which kernels support broadcasting ARP replies, and if they broadcast all ARP replies or just those with link-local IP addresses in the body.

Generic ARP Behaviour Tests

describe set-up (with three hosts)

Description of Problem Scenario's

Link-Local ARP Behaviour Tests

Setup

Take three nodes, and put them in a LAN, without external connectivity.
Configure either link-local (169.254/16) or private (10/8) IP addresses on the hosts.
Make sure the ARP cache is empty (for example do arp -d -a -n), check with arp -a -n (the -n makes sure no resolving is done, since that may generate an ARP request).
Do a single connection request, for example using ping -c 1 <IP of host 2> and check with ethereal or tcpdump arp if the ARP replies are unicasted or broadcasted. You can check by either decoding the ARP packet with ethereal or by just checking if host 3 sees the packet or not.

Linux 2.4.26 kernel

With private addresses: unicasted
With statically configured link-local addresses: unicasted

Linux 2.6.6 and 2.6.8 kernels

With private addresses: unicasted
With statically configured link-local addresses: unicasted

Mac OS 10.3.9

With private addresses: unicasted
With statically configured link-local addresses: broadcasted
With bootpd automatically configured link-local addresses: broadcasted

Kernel Patch

Here is a short kernel patch, which makes a linux kernel broadcast ARP replies, if they concern link-local (zerconf IP addresses). The patch was written by David Daney for a 2.6.16.1 kernel, but also succesfully applied to a 2.6.8 and even a 2.4.27 kernel (apparently, the arp.c code doesn't change much these days). It was based on a earlier patch∞ by FreekDijkstra.

# apply using cd linux-2.6.16.1 ; patch -p0 < ipv4ll.patch
--- net/ipv4/arp.c.orig 2006-03-31 13:44:50.000000000 -0800
+++ net/ipv4/arp.c 2006-04-05 13:33:19.000000000 -0700
@@ -690,6 +690,11 @@ void arp_send(int type, int ptype, u32 d
   if (dev->flags&IFF_NOARP)
   return;

+ /* If link local address (169.254.0.0/16) we must broadcast
+ * the ARP packet. See RFC 3927 section 2.5 for details. */
+ if ((src_ip & htonl(0xFFFF0000UL)) == htonl(0xA9FE0000UL))
+ dest_hw = NULL;
+
   skb = arp_create(type, ptype, dest_ip, dev, src_ip,
   dest_hw, src_hw, target_hw);
   if (skb == NULL)

This patch was extensively∞ discussed∞ on the netdev mailing list for network related Linux kernel development, but so far not picked up upstream.

Measurements

machines:

Mac, OS 10.4
Linux with patched kernel

Seperate network, give Mac same (fixed) IP as Linux. Join. Linux should reconfigure, but indeed the Mac complains and refuses to join the network.

Other problems include that computers are indeed reconfigured, but the reverse lookup still is to the older hosts, giving incorrect results from an end-user persepctive.