🚀 go-pugleaf

>> Recently we discovered strange behaviour in 9.0(1).
>> We route tcp/ip decnet and appletalk and bridge LAT in a 
>> newly installed MGR. 
>> ARP requests done on lan-s connected to this router are
>> FORWARDED to all interfaces! Even worse, since they are
>> forwarded to a AGS with 8.3(3), the AGS has no way of
>> protecting himself, but instead the AGS will put the ARP-s
>> to all of hi's interfaces. In one case he substituded the
>> original ip-address with the AGS ip-address.
>> ...

We have also seen some very troubling ARP related problems in
9.0(1).  At this time we are using an ftp'd copy of 9.0(1.10)
that seems to solve the problems.  My advice would be if you use
bridging don't use 9.0(1).

Most of the nasty behavior seems to be related to the unexpected 
behavior on the Cisco routers related to the handling of ARP >reply<
packets.  For the record the queries are broadcast and are filtered
>HOWEVER< replies are bridged, in our case to darn near everywhere on
the net. [Please see question below.]

What seemed to happen under 9.0(1) was that the bridged ARP reply
packets caused routers to install incorrect arp cache entries for
related routes.  For example an ARP reply for a host that was known
to be beyond another router caused an update of ALL arp cache entries
for that net PLUS it updated the cache entry for the router.  (Turns
off the router rather nicely.)  Rogue hosts, with the wrong IP address
for the cable segment in question, absolutely triggered this arp cache
corruption.

My questions for everyone out there are:

   Why should these response packets be bridged to everyhwere?

	Yes, they truly are not IP packets by definition and are
	bridge-able.  However, from what I can see on the tcpdumps
	the destination host's location is well known, so it seems to
	me that bridging these off of the origin segment is almost
	never correct.  Is this a feature or is it done for some reason?

   Is the solution to this to install a filter that stops all bridged
   arp packets?  Does this stop anything else I'm likely to need?
   (Like my AppleTalk)

As always thanks in advance.
	Paul Hyder
	NCAR
	Boulder,CO