Re: vr0 only working if tcpdump -n -i vr0 is running

[Chuck Swiger <cswiger%mac.com@localhost>]

On Oct 12, 2011, at 2:45 PM, Jonathan Schleifer wrote:
> Am 12.10.2011 um 23:38 schrieb Chuck Swiger:
>> As you discovered, tcpdump is putting the NIC into promiscuous mode, so it 
>> processes all packets it sees, rather than ignoring packets which it doesn't 
>> believe it should listen to.
> 
> Ok, so without promiscious mode, the hardware is ignoring packets for which 
> it believes that they are not addressed for it?

Right.

>> This tends to indicate layer-2 problems such as it is not generating 
>> ARPOP_REPLYs for its IP with the right MAC, or the ARP tables on other 
>> machines in the network don't match.
>> 
>> Running "tcpdump -exxn -s 0 arp"
> 
> This generates a lot of output, as I'm in a university network. Is there 
> anything specific you want to know?

Looks for ARPOP_REQUESTS for your IP and what your machine sends back in 
response.  Pinging your machine from another system on the LAN should be enough 
to make sure such traffic occurs.

Verify that the actual MAC you are sending in the header matches what is in the 
body of the ARPOP_RESPONSE.

>> and "arp -a" ought to be informative.
> 
> The output looks sane, it has the DHCP server and the gateway and all local 
> machines behind my NAT.

Look at what some other machine on the segment with your vr0 NIC has for your 
IP in it's ARP table.

[ ... ]
>> What does "signal" mean here?
>> 
>> Ethernet link light?  Seeing traffic from the rest of the network?
> 
> Ethernet link light. I have a WiFi AP which only gets a link light if I 
> reboot it several times, I got a few NICs which never find a link and I got a 
> few devices (MacBook Pro, PowerBook) which always get a link.

Do the other devices work if you use a crossover cable, instead?  Apple 
hardware provides MDI/MDIX autoswitching; maybe your other NICs having problems 
do not....

Regards,
-- 
-Chuck