3 Replies Latest reply on May 22, 2012 8:25 PM by mynar

    SG 530 Error - kernel: neigh_alloc(): neighbour table flood for neigh_table

      Hello,

       

      I'm having a difficult time trying to isolate the cause of this error message.  According to the KB article, it could be a virus or too many items sitting behind the unit.  I've scanned the 2 computers to eliminate the prior (even to the point of disconnecting the switch from the unit) and since there are only 3 total items connected to the unit, I believe the latter is not the cause either.  One minute of System Log capture is given below. I have never seen this particular problem in the many years I've been using these units for branch office IPSEC connections to our corporate location.  As closely as I can determine, the unit is getting flooded with ARP requests on the WAN interface.

       

      We recently switched this office from a SDSL line to a cable modem connection with a static IP block. I have replaced the unit in question with a new (previously decommissioned unit from another office) SG530, fresh firmware update on said unit.  I manually rebuilt the configuration on the new unit instead of restoring from a backup configuration, with the same results shown below. 

       

      My current thought is to take this issue up with my cable provider. I wanted to check here before I did that so I have solid ground to argue with the generally clueless T1 support people and get to someone that actually knows what an ARP packet is. Packet Capture Sanitized to protect the guilty. Am I correct in presuming that there is nothing I can do about the flooding other than notifying my ISP that something is wrong on their end?  The IP block I'm evidently receiving ARP's for isn't even close to what my assigned block is.

       

      Unit: SG530 Version 3.1.6 --  Tue, 29 Jul 2008 18:01:19 +1000

      Error Message:

      May 11 03:16:58 kernel: neigh_alloc(): neighbour table flood for neigh_table

      May 11 03:17:02 last message repeated 29 time(s)

      May 11 03:17:02 kernel: NET: 29 messages suppressed.

      May 11 03:17:02 kernel: Neighbour table overflow.

      May 11 03:17:02 kernel: neigh_alloc(): neighbour table flood for neigh_table

      May 11 03:17:07 last message repeated 30 time(s)

      May 11 03:17:07 kernel: NET: 30 messages suppressed.

      May 11 03:17:07 kernel: Neighbour table overflow.

      May 11 03:17:08 kernel: neigh_alloc(): neighbour table flood for neigh_table 

      May 11 03:17:12 last message repeated 28 time(s)

      May 11 03:17:12 kernel: NET: 28 messages suppressed.

      May 11 03:17:12 kernel: Neighbour table overflow.

      May 11 03:17:12 kernel: neigh_alloc(): neighbour table flood for neigh_table

      May 11 03:17:17 last message repeated 69 time(s)

      May 11 03:17:17 kernel: NET: 69 messages suppressed.

      May 11 03:17:17 kernel: Neighbour table overflow.

      May 11 03:17:17 kernel: neigh_alloc(): neighbour table flood for neigh_table 

      May 11 03:17:22 last message repeated 40 time(s)

      May 11 03:17:22 kernel: NET: 40 messages suppressed.

      May 11 03:17:22 kernel: Neighbour table overflow.

      May 11 03:17:23 kernel: neigh_alloc(): neighbour table flood for neigh_table

      May 11 03:17:27 last message repeated 32 time(s)

      May 11 03:17:27 kernel: NET: 32 messages suppressed.

      May 11 03:17:27 kernel: Neighbour table overflow.

      May 11 03:17:28 kernel: neigh_alloc(): neighbour table flood for neigh_table 

      May 11 03:17:36 last message repeated 6 time(s)

      May 11 03:17:36 kernel: NET: 6 messages suppressed.

      May 11 03:17:36 kernel: Neighbour table overflow.

      May 11 03:17:37 kernel: neigh_alloc(): neighbour table flood for neigh_table 

      May 11 03:17:37 last message repeated 4 time(s)

      May 11 03:17:37 kernel: NET: 4 messages suppressed.

      May 11 03:17:37 kernel: Neighbour table overflow.

      May 11 03:17:37 kernel: neigh_alloc(): neighbour table flood for neigh_table 

      May 11 03:17:42 last message repeated 25 time(s)

      May 11 03:17:42 kernel: NET: 25 messages suppressed.

      May 11 03:17:42 kernel: Neighbour table overflow.

      May 11 03:17:42 kernel: neigh_alloc(): neighbour table flood for neigh_table

      May 11 03:17:47 last message repeated 41 time(s)

      May 11 03:17:47 kernel: NET: 41 messages suppressed.

      May 11 03:17:47 kernel: Neighbour table overflow.

      May 11 03:17:48 kernel: neigh_alloc(): neighbour table flood for neigh_table 

      May 11 03:17:52 last message repeated 24 time(s)

      May 11 03:17:52 kernel: NET: 24 messages suppressed.

      May 11 03:17:52 kernel: Neighbour table overflow.

      May 11 03:17:52 kernel: neigh_alloc(): neighbour table flood for neigh_table

      May 11 03:17:57 last message repeated 23 time(s)

      May 11 03:17:57 kernel: NET: 23 messages suppressed.

      May 11 03:17:57 kernel: Neighbour table overflow.

      May 11 03:17:58 kernel: neigh_alloc(): neighbour table flood for neigh_table

       

      Packet Capture from WAN port:

      03:32:16.133579 arp who-has 75.X.Y.Z tell 75.X.Y.Z

      03:32:16.142578 arp who-has 65.X.Y.Z tell 65.X.Y.Z

      03:32:16.157585 arp who-has 67.X.Y.Z tell 67.X.Y.Z

      03:32:16.183591 arp who-has 73.X.Y.Z tell 73.X.Y.Z

      03:32:16.405646 arp who-has 73.X.Y.Z tell 73.X.Y.Z

      03:32:16.491663 arp who-has 75.X.Y.Z tell 75.X.Y.Z

      03:32:16.534676 arp who-has 67.X.Y.Z tell 67.X.Y.Z

      03:32:16.578685 arp who-has 76.

      03:32:16.672706 arp who-has 75.

      03:32:16.722715 arp who-has 75.

      03:32:16.741719 arp who-has 65.

      03:32:16.793735 arp who-has 75.

      03:32:16.812736 arp who-has 76.

      03:32:16.909759 arp who-has 73.

      03:32:16.970776 arp who-has 65.

      03:32:17.138816 arp who-has 73.

      03:32:17.358870 arp who-has 73.

      03:32:17.572921 arp who-has 75.

      03:32:17.581919 arp who-has 73.

      03:32:17.642934 arp who-has 75.

      03:32:17.722954 arp who-has 75.

      03:32:17.808974 arp who-has 73.

      03:32:17.812977 arp who-has 65.

      03:32:17.883001 arp who-has 65.

      03:32:17.902998 arp who-has 67.

       

      EDIT:  Sorry if anyone saw this before I edited, evidently posting in non-html so I could copy and paste smashed everything together.

       

      Message was edited by: mynar on 5/11/12 2:50:27 AM CDT