[OxLUG] Responses to duplicated ICMP packets

Top Page
Attachments:
Message as email
+ (text/plain)
Delete this message
Reply to this message
Author: James Davis
Date:  
To: Oxlug
Subject: [OxLUG] Responses to duplicated ICMP packets
I have a Debian/squeeze host running under VMWare. The VMWare virtual
switch is trunking with a pair of Cisco switches which are carrying an
RSPAN VLAN*. The host has one network interface connected to the default
VLAN eth0, and the other to this RSPAN VLAN eth1.

eth0 is configured with an IP address and when pinged it returns
multiple responses. One response is expected, and my best guess is that
the two extra responses are in response to captured icmp packets
arriving over the RSPAN VLAN on eth1. Disconnecting eth1 in VMWare stops
the extra responses.

The duplicated packets arriving at eth1 I can cope with; but does anyone
have any idea why my linux install is deciding to respond to packets
received on another interface?

Apologies if my description isn't clear :)

James

* Cisco terminology, the VLAN over which traffic sniffed from various
interfaces is transported.