Monday, July 28, 2008

Fascinating behavior from a linux host

Is this undocumented behavior, or am I missing something obvious?

I am having a very strange issue with one of my Linux hosts.

The primary symptom is that the host responds on two IPs, when ifconfig clearly shows that eth0 is the only interface up (besides the loopback), and only has one IP address.

The arp table on each host that connects to the machine in question shows the same MAC address, regardless of which IP you connect to.

Pinging either IP address from the machine results in responses of such a small amount of time (0.034 ms) that I have no doubt that packets are not leaving the interface.

Running ipconfig -a indicates that eth1 is assigned the alternate IP address that the machine is responding to, however all indications are that the line is down and upon physical examination of the machine, I have verified that there is only one ethernet cable plugged in, and it is going into eth0

At this point, I'm not really sure how to proceed. Obviously I can remove the alternate IP address from eth1, but I'm still at a loss as to why the machine
A) responds positively to an IP address assigned to a down interface
B) sends that request through another, up interface
C) responds with the MAC address of the up interface

I've checked, and there are no iptables rules, there are no specific routing instructions, and neither interface shows up in the arp table of the host in question. All of these are proper conditions for this host.

Any comments or suggestions?