OS-5781

current proxy ARP defence is altogether too intense

Status:
Resolved
Created:
2016-11-09T17:46:55.000-0500
Updated:
2025-11-21T11:06:27.658-0500

Description

When the system receives an ARP frame that appears to be "from" an address for which we believe we have authoritative information, it is programmed to respond with a gratuitous ARP broadcast to defend our understanding of the network.

It seems that this response will currently be sent for every questionable ARP frame of this type that is received, even if they arrive at wire speed. This can be disruptive to a network, so we should try to limit the rate at which we defend our ARP entries to something like one broadcast defence per second. While rate limiting, we should nonetheless be sure to have the "last word".

Comments (3)

Former user commented on 2017-02-16T13:50:56.000-0500:

This sounds like the same thing I discovered back in 2014 in OS-3379.

Dan McDonald commented on 2019-07-09T14:11:42.622-0400:

New data on OS-3379#icft=OS-3379 may affect this as well.

Dan McDonald commented on 2025-11-21T11:06:27.457-0500:

History dive shows this open, and it’s likely fixed by OS-3379.