[dpdk-users] arp behaviour on dpdk

Stephen Hemminger stephen at networkplumber.org
Tue Aug 16 18:18:41 CEST 2016

On Tue, 16 Aug 2016 12:10:50 +0530
Raja Jayapal <raja.jayapal at tcs.com> wrote:

> Hi Nishant,
> Please find attachment for the pcap file.
> Thanks,
> Raja
> -----Nishant Verma <vnish11 at gmail.com> wrote: -----
> To: Raja Jayapal <raja.jayapal at tcs.com>
> From: Nishant Verma <vnish11 at gmail.com>
> Date: 08/13/2016 02:42AM
> Cc: "users at dpdk.org" <users at dpdk.org>, Nagaratna Patagar <nagaratna.patagar at tcs.com>
> Subject: Re: [dpdk-users] arp behaviour on dpdk
> Hi Raja,
> What i understand is that Br1(linux machine) is getting ARP request but not sending ARP Response? 
> If this is the case, it means either packet is not liked by Br1 hence dropped or some how capture is not right.
> Can you share pcap file,  captured at Br1.
> On Thu, Aug 11, 2016 at 3:02 AM, Raja Jayapal <raja.jayapal at tcs.com> wrote:
> Hi All,
>  I am running dpdk on KVM and would like to understand the arp behaviour on dpdk ports.
>  The topology is as below.
>  br0(> vnet0 -----> dpdk(NIC1- e1000)------->dpdk(NIC2-e1000)------>vnet1----->br1(
>  I am sending ARP packet from br0 using PackETH tool destined to br1.
>  I have  edited the dpdk l2fwd code in such a way that , the destination is broadcast address(ffff).
>  In br1 , i can see the arp resquest, but the host bridge is not responding for the arp request.
>  In br1:
>  =====
>  tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
>  listening on br1, link-type EN10MB (Ethernet), capture size 65535 bytes
>  12:21:15.459667 ARP, Request who-has (00:0a:e7:2c:44:2b (oui Unknown)) tell, length 46
>  12:21:15.651610 ARP, Request who-has (00:0a:e7:2c:44:2b (oui Unknown)) tell, length 46
>  12:21:15.867692 ARP, Request who-has (00:0a:e7:2c:44:2b (oui Unknown)) tell, length 46
>  In l2fwd application example also, the arp packets are getting received on the adjacent ports, but the arp reply has not been sent back from br1.
>  Could you please let me know how to make the host(br1) to reply the arp request.

The host kernel has a number of checks to prevent ARP spoofing.
Most likely your packet is invalid by one of these checks.
Linux ARP does not keep many statistics, so that doesn't help.

Look at the arp_ignore sysctl flag and read kernel source for net/ipv4/arp.c function
arp_process to see what is going on. If you are completely stuck build a custom
kernel and instrument kernel with printk's there.

More information about the users mailing list