0

Recently I've found on my firewall logs growing count of dropped packets going from and to the same lan network...

I've checked everything twice, netmask is ok, no additional routes...

If I ping host 10.0.0.3/24 from host 10.0.0.2/24 and this hosts exists in network everything is working fine, and the router doesn't know about it (packets are going straight from host A to B), but if host B disappear from network packets are going to default gateway...

I've observed this only for Windows machines - all linuxes are ok...

Anyone knows why windows is doing such thing and since when?

EDIT

Here is some log of fireHOL

Feb 5 20:36:26 black PASS-unknown: IN=lan0.20 OUT=lan0.20 MAC=(..) SRC=10.0.0.2 DST=10.0.0.3 LEN=48 TOS=00 PREC=0x00 TTL=127 ID=14503 DF PROTO =TCP SPT=62931 DPT=3050 SEQ=3210101748 ACK=0 WINDOW=8192 SYN URGP=0 MARK=0

Dropped packet is not ICMP - it's TCP SYN packet - one of our applications it trying to connect to firebird database

Improve this question
6
  • It sounds like you're seeing ARP requests for the ip being queried hitting your router, which is perfectly normal. All local hosts, including the router, will receive ARP queries for ip addresses on the subnet. When one local host needs to communicate with another local host and it doesn't have that host's MAC address in it's ARP cache then it will broadcast an ARP request to find the MAC address of the ip address of the destination host. Can you give us some details about this dropped traffic on the router? Commented Feb 9, 2017 at 15:48
  • @joeqwerty - thanx for your suggestions but it's not ICMP... this also was the first thing that came to my mind, but it's TCP SYN - added some log Commented Feb 9, 2017 at 21:42
  • DES = 10.0.0.3, it's what ? as it's local that one Commented Mar 1, 2017 at 0:22
  • @yagmoth555 - Thanx... it seems that only you read everything with an attempt to understand the problem since no one have found this mistake. Of course ping was from 0.2 to 0.3, 10.0.0.1 is default gateway which produced this log. Commented Mar 1, 2017 at 7:01
  • Strange that your gateway seen that, as the packet seem well-wrote, src and dst ok. No sign the gateway should see it. A switch problem ? Commented Mar 2, 2017 at 1:57

1 Answer 1

Reset to default
4

I found this on my network also and took a few days to track it down after losing my mind on what I was capturing on the network. It's a feature called Neighbor Unreachability Detection.

Essentially after the initial ARP request for an IP, if Windows does not receive an ARP reply it will send to the default gateway to see if the gateway can find where the device resides. You can see this behavior when you ping an unused IP (that hasn't been ARP'ed for already) in your subnet the first response will be Destination Host Unreachable where the rest will show Request timed out.

This behavior started in Windows Vista when the IPv4 and IPv6 networking stacks were combined.

You should be able to disable this behavior using

netsh interface ipv4 set interface "<Interface Name>" nud=disabled store=persistent

Check out the link below, towards the bottom under Neighbor Unreachability, for an explanation and more information.

https://blogs.technet.microsoft.com/networking/2009/04/24/source-ip-address-selection-on-a-multi-homed-windows-computer/

Improve this answer
1
  • Thanx men - You're the best :) Commented May 17, 2017 at 12:19

You must log in to answer this question.

Start asking to get answers

Find the answer to your question by asking.

Ask question

Explore related questions

See similar questions with these tags.