On Wed, Dec 21, 2022 at 10:07 PM Saku Ytti <saku@ytti.fi> wrote:
I don't really think ARP/ND is good candidate like Herring suggested, because it's cyclical, instead of exactly single event, but not impossible.
Suppose you have a loose network cable between your Linux server and a switch. Layer 1. That RJ45 just isn't quite solid. It's mostly working but not quite right. What does it look like at layer 2? One thing it can look like is a periodic carrier flash where the NIC thinks it has no carrier, then immediately thinks it has enough of a carrier to negotiate speed and duplex. How does layer 3 respond to that? 1s: send ping toward default router 1.1s: ping response from remote server 2s: send ping toward default router 2.1s: ping response from remote server 2.5s: carrier down 2.501s: carrier up 3s: queue ping, arp for default router, no response 4s: queue ping, arp for default router, no response 5s: queue ping, arp for default router, no response 6s: queue ping, arp for default router, no response 7s: queue ping, arp for default router 7.01s: arp response, send all 5 queued pings but note that the earliest is more than 4 seconds old. 7.1s: response from all 5 queued pings. Cable still isn't right though, so in a few seconds or a few minutes you're going to get another carrier flash and the pattern will repeat. I've also seen some cheap switches get stuck doing this even after the faulty cable connection is repaired, not clearing until a reboot. Regards, Bill Herrin -- For hire. https://bill.herrin.us/resume/