Re: What's the deal with return-rst?

On Wed, 15 Oct 2008, Joseph Spenner wrote:

> Just taking a random stab at this, but do you happen to have any Dell servers on your network by chance?
> 
> http://opensolaris.org/jive/thread.jspa?messageID=208934

We have a heterogenous network with hundreds of hosts, so I would be
surprised if I *didn't* have one.

So, if I read this right, you speculate that a bad Broadcom NIC is
poisoning the ARP cache of the firewall hosts?  If the gateway's ARP
entry got poisoned, it would certainly explain why remote networks seem
to not get RST/ACK packets whereas local ones do.

But the problem symptoms I have doesn't seem to match the blog page
description:

 	- I don't see widespread network problems: it happens on
 	a host by host basis.

 	- I also couldn't quite tell from that blog page whether only
 	Solaris hosts with bge0 interfaces get affected, or not, but
 	the firewall hosts I am talking about has a hme0 interface.

 	- the "netstat -p" output didn't change during the transition
 	from working to non-working,

One more data point:

 	- a different Solaris version running a self-compiled IPF
 	version also exhibits this same problem:

 		uname -a: SunOS test2 5.9 Generic_122300-02 sun4u sparc SUNW,Ultra-1
 		IPF -v: ipf: IP Filter: v4.1.28 (600)

At least with the last case, I can insert debugging code into IPF.
Any more hints on how to debug this?

Joseph Tam <[email protected]>