Re: kernel: Neighbour table overflow?

Hi Malcolm,

On Tue, Jun 23, 2009 at 08:19:43AM +0100, Malcolm Turnbull wrote:
> We have a customer using haproxy with the following problem, is this
> anything obvious?
>
> We are encountering Server Timeout problem from the client pc to
> access the servers through loadbalancer. We have two (2) VIP and six
> (6) Real Servers and all of those servers are Oracle.
>
> I checked on the /var/log/messages, it says the following message:
>
> Jun 19 11:26:48 lbmaster kernel: printk: 157 messages suppressed.
> Jun 19 11:26:48 lbmaster kernel: Neighbour table overflow.
> Jun 19 11:26:48 localhost haproxy[2139]: Connect from 10.32.85.18:1190 to
> 10.101.24.25:8000 (VIP_10_101_24_25/HTTP)
> Jun 19 11:26:48 localhost haproxy[2139]: Connect from 10.32.85.18:1191 to
> 10.101.24.25:8000 (VIP_10_101_24_25/HTTP)
> Jun 19 11:26:48 localhost haproxy[2139]: Connect from 10.9.84.69:1327 to
> 10.101.24.25:8000 (VIP_10_101_24_25/HTTP)
> Jun 19 11:26:49 localhost haproxy[2139]: Connect from 10.4.2.129:1165 to
> 10.101.24.25:8000 (VIP_10_101_24_25/HTTP)
> Jun 19 11:26:49 localhost haproxy[2139]: Connect from 10.32.85.18:1192 to
> 10.101.24.25:8000 (VIP_10_101_24_25/HTTP)
> Jun 19 11:26:49 localhost haproxy[2139]: Connect from 10.134.95.110:1344
> to 10.101.24.25:8000 (VIP_10_101_24_25/HTTP)
> Jun 19 11:26:53 lbmaster kernel: printk: 156 messages suppressed.
> Jun 19 11:26:53 lbmaster kernel: Neighbour table overflow.

normally you get that when the ARP table overflows (128 entries by default). This happens when you have more than 128 hosts on the LAN, but it may also happen under some circumstances if there is one equipment doing some proxy-arp somewhere. You should check "arp -a" on the machine to see what is happening.

it is also possible that your machine receives spoofed packets from its own LAN and tries to respond, and as such, add ARP entries for the spoofed hosts.

Regards,
Willy Received on 2009/06/24 14:42