Re: [dpdk-users] arp behaviour on dpdk

[Stephen Hemminger <stephen@networkplumber.org>]

On Tue, 16 Aug 2016 12:10:50 +0530
Raja Jayapal <raja.jayapal@tcs.com> wrote:

> Hi Nishant,
> 
> Please find attachment for the pcap file.
> 
> Thanks,
> Raja
> 
> -----Nishant Verma <vnish11@gmail.com> wrote: -----
> To: Raja Jayapal <raja.jayapal@tcs.com>
> From: Nishant Verma <vnish11@gmail.com>
> Date: 08/13/2016 02:42AM
> Cc: "users@dpdk.org" <users@dpdk.org>, Nagaratna Patagar <nagaratna.patagar@tcs.com>
> Subject: Re: [dpdk-users] arp behaviour on dpdk
> 
> Hi Raja,
> 
> What i understand is that Br1(linux machine) is getting ARP request but not sending ARP Response? 
> If this is the case, it means either packet is not liked by Br1 hence dropped or some how capture is not right.
> 
> Can you share pcap file,  captured at Br1.
> 
> 
> 
> On Thu, Aug 11, 2016 at 3:02 AM, Raja Jayapal <raja.jayapal@tcs.com> wrote:
> Hi All,
>  
>  I am running dpdk on KVM and would like to understand the arp behaviour on dpdk ports.
>  The topology is as below.
>  
>  br0(192.168.100.10)----> vnet0 -----> dpdk(NIC1- e1000)------->dpdk(NIC2-e1000)------>vnet1----->br1(192.168.100.20)
>  
>  I am sending ARP packet from br0 using PackETH tool destined to br1.
>  I have  edited the dpdk l2fwd code in such a way that , the destination is broadcast address(ffff).
>  In br1 , i can see the arp resquest, but the host bridge is not responding for the arp request.
>  
>  In br1:
>  =====
>  tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
>  listening on br1, link-type EN10MB (Ethernet), capture size 65535 bytes
>  12:21:15.459667 ARP, Request who-has 192.168.100.20 (00:0a:e7:2c:44:2b (oui Unknown)) tell 192.168.100.10, length 46
>  12:21:15.651610 ARP, Request who-has 192.168.100.20 (00:0a:e7:2c:44:2b (oui Unknown)) tell 192.168.100.10, length 46
>  12:21:15.867692 ARP, Request who-has 192.168.100.20 (00:0a:e7:2c:44:2b (oui Unknown)) tell 192.168.100.10, length 46
>  
>  In l2fwd application example also, the arp packets are getting received on the adjacent ports, but the arp reply has not been sent back from br1.
>  
>  Could you please let me know how to make the host(br1) to reply the arp request.

The host kernel has a number of checks to prevent ARP spoofing.
Most likely your packet is invalid by one of these checks.
Linux ARP does not keep many statistics, so that doesn't help.

Look at the arp_ignore sysctl flag and read kernel source for net/ipv4/arp.c function
arp_process to see what is going on. If you are completely stuck build a custom
kernel and instrument kernel with printk's there.