Re: Virtual MAC really necessary?

There are certain security features common to switches that will filter 
gratuitous arp's sent from ports that do not match the known values.  Most 
do not enable this feature.  I have seen gratuitous arps dropped because 
of lack of queue space.  Gratuitous arp's must be received by the network 
device itself and copied to every port, this means that they will sit in 
the queue longer than normal messages. If there are a large amount of arps 
sent in a short period they could easily fill the queues as the switch 
tries to process them.  This will lead to arp's being dropped  (as well as 
normal traffic) and devices not having accurate arp caches.  I think the 
virtual mac was created to preclude this situation or something similar. 
While it may not be absolutely necessary it is helpful.





"Roland Abt" <[email protected]> 
01/15/08 04:29 AM

To
"Sylwester Chojkiewicz" <[email protected]>, 
[email protected]
cc
[email protected]
Subject
Re: [VRRP] Virtual MAC really necessary?






Sylwester,

I see your point. But sending multiple ARP Requests would not be an 
unsolvable problem :)
Again, has anybody seen devices ignoring gratuitous ARPs? And what kind of 
 
gratuitous ARP should be used (request or reply)?

Best regards,
Roland




On Mon, 14 Jan 2008 18:37:29 +0100, Sylwester Chojkiewicz 
<[email protected]> wrote:

> Using the physical MAC address may also contribute to opening of another
> issue: a race conditions when two Standby virtual routers compete for 
> Master
> state.
>
> The specific situation occurs when two Masters become active 
> approximately
> at the same time. As a result of protocol defined arbitration mechanism, 
 
> the
> Master with lower primary IP address will be forced to switch to Backup
> state.  It is fine as long as out of these two Masters, the legitimate 
> one,
> which will remain its status, will be also the last one who has sent the
> gratuitous ARP (just considering the IPv4 case).
>
> However, what will happen if the gratuitous ARP from the legitimate 
> Active
> is overwritten in device by that one coming from virtual router that 
will
> assume the Standby role?
>
> After receiving advertisement from another virtual router, should not 
the
> legitimate Active re-broadcast the gratuitous ARP - just in any case - 
> even
> after a short delay?
>
> Sylwester
>
>
>
>   _____
>
> From: [email protected] [mailto:[email protected]]
> Sent: Monday, January 14, 2008 12:00 PM
> To: Roland Abt
> Cc: [email protected]
> Subject: Re: [VRRP] Virtual MAC really necessary?
>
>
>
> The advantage of the virtual mac is that it is a multicast address so 
> both
> devices should receive the traffic regardless of their failover state.
> Also, the virtual mac allows failover with out any of the devices having 
 
> to
> change their arp entry.  The gratuitous arp just serves to update the
> forwarding table in the switch(s).  If the gateway mac was suddenly a
> physical address you may run into issues if some of the attached devices
> don't receive the gratuitous arp or don't process it because of 
security.
>
>
>
>
>
> "Roland Abt" <[email protected]>
>
> 01/14/08 11:31 AM
>
>
> To
>
> [email protected]
>
>
> cc
>
>
>
> Subject
>
> [VRRP] Virtual MAC really necessary?
>
>
>
>
>
>
>
>
> Hello everybody
>
> I want to implement my own VRRP protocol. The protocol itself is not 
that
> tricky, but using a virtual MAC seems like a big hurdle to me. The
> standard states that the MAC address of the new Master has to be 
> published
> in a gratuitous ARP (request/reply). I think this already should help to
> update the ARP table of every device. Does anybody know of a situation
> where publishing the physical MAC would cause any trouble? Are there any
> known devices that would not update their ARP table in case of such a
> gratuitous ARP?
>
> Best regards and thanks in advance for your time,
> Roland
>
>
> PS:
> According to the Ethereal Wiki 
> ( <http://wiki.ethereal.com/Gratuitous_ARP>
> http://wiki.ethereal.com/Gratuitous_ARP) a
> gratuitous ARP can be either a request or a reply. Any experience which
> one is better?
>
> _______________________________________________
> vrrp mailing list
> [email protected]
>  <https://www1.ietf.org/mailman/listinfo/vrrp>
> https://www1.ietf.org/mailman/listinfo/vrrp

_______________________________________________
vrrp mailing list
[email protected]
https://www1.ietf.org/mailman/listinfo/vrrp