OpenSUSE 11.1 - Massive amount of ARP traffic

[rekabis]

Greetings,

Been using OpenSUSE since 10.2, and while I am not a Linux "newbie", I am closer to being a newbie than an expert.

Just installed OpenSUSE 11.1 on a machine which is destined to be my primary workstation once I work out all the bugs. This machine currently has three network cards in it. Two are built in -- a regular 10/100 (connected, live with DHCP) and a Gigabit (disconnected). The third is a PCI-X Compaq Gigabit card that I put in simply to confirm that it works in a traditional 33Mhz 32-bit slot.

My problem is that I am getting a massive amount of network traffic that tends to come and go. When I run Wireshark to sniff the data, I discover it is coming from my own 10/100 card, and it is broadcast ARP data. Much of it is simply "Who has 24.67.66.34? Tell 24.67.64.1", with very similar IP addresses, but not often the same ones. This all seems restricted to the 24.67.xx.xx set of addresses.

I have never had a Linux machine be so "chatty" before. Is this normal? All I know is that my machine is putting out a lot of chatter -- at least 2-3 KiB/s of data is being pumped out, according to System Monitor. I have two other OpenSUSE machines, one 11.0 and the other 10.3, and neither are like this.

Oh, and BTW, it also causes a significant processor hit. While I am running a dual-core Opteron, it still would be nice to solve this issue. This is my third re-installation and the issue is persisting.

Thanks,
...René

[rbkumaran]

IP 24.67.64.1 seems to be an ISP "Shaw High-Speed Internet".

Do you know this company? Or are they your ISP? If so did you install any software provided by this ISP.

[ken_yap]

Shaw, huh? Don't they do cable internet?

OP, did you by any chance connect that interface to a cable modem? A cable connection is a shared medium and you will see all the broadcast traffic on it. That includes stupid users who have connected up their Windows machines directly to the cable and are sending everyone on the segment their broadcast traffic. Shouldn't you activate a firewall on that interface?

[rekabis]

Yes, this machine is directly hooked up to the Shaw cable modem (for now - out of ports on my LAN switch). Yes, I do have the openSUSE firewall turned on, with the highest settings enabled. No, Shaw doesn’t provide any software for Linux users - only Micro$oft users, so that isn’t a problem.

And no, it does not appear that I am seeing other machine’s ARP traffic; Wireshark clearly has my network card (“Riverdel_c7:07:a0”) as the source of all this traffic. Although, with the ARP traffic it is only stating the card’s name, and not the card’s IP address as it does with normal network communication.

In fact, the pattern of the ARP traffic is this:

“Who has 24.67.xx.xx? Tell 24.67.xx.1”

The xx are numbers which change with each ARP request, but the rest are all identical with each ARP request.

Suggestions?

[ken_yap]

Have you got a mdns daemon or something like that bound to that interface?

[rekabis]

This is a clean install, with default openSUSE packages installed. I have mostly programming environments (PHP, Perl, Ruby, Tcl/Tk, C/C++/Objective-C, Mono, Java, etc.) installed, along with Apache2 and Tomcat.

Nothing else, like DNS, mail server, ftp server, etc.. I don’t need those on my workstation.

If an mdns daemon is standard with that kind of an installation, then yes. Otherwise, no. What should I be looking for?

[ken_yap]

avahi-daemon