machine ARPs for itself

[infrared013]

DOes anyone know what it means when a device ARPs for itself? WHen I run a tcpdump on a particular connection it is just nothing but lines and lines and lines of this machine arping for itself.

Im not sure if this one is something that can be answered as it is or if more info is needed. Just happened to think about it tonight at home and thought I would throw it out there, I can provide more info such as exact output from the tcpdump and what not if it might help get me somewhere. This partcular connection is a site to site encrypted tunnel where we are also using NAT (to complicate things further). The connection originates from a non-routable address destined for the remote end, is NAT'ed to a public IP and on the other end the same thing and also vice versa. I see the public IP come in and be accepted by the FW but it is when I do the tcpdump on the private IP of the receiving machine to see if the NAT is working properly that I noticed this.

If this makes any sense at all and I havnt gone rabling on aimlessly I would appreciate any of your expert analysis! Sometimes I enjoy asking the folks on here my questions rather than my own co-workers! for multiple reasons!

[laril]

This is a feature called gratuitous arp. Not sure about your special situation, but CheckPoint utilizes this at least with clustering.

For more information see e.g.

Gratuitous ARP - The Ethereal Wiki

-laril-