From mboxrd@z Thu Jan  1 00:00:00 1970
To: 9fans@cse.psu.edu
Subject: Re: [9fans] ip bug?
From: "Russ Cox" <rsc@swtch.com>
Date: Mon, 14 Jan 2008 19:02:38 -0500
In-Reply-To: <2306f876a0a7449b68b07751e72e37e1@quanstro.net>
MIME-Version: 1.0
Content-Type: text/plain; charset="US-ASCII"
Content-Transfer-Encoding: 7bit
Message-Id: <20080115000239.A5DA21E8C1C@holo.morphisms.net>
Topicbox-Message-UUID: 2e63fdee-ead3-11e9-9d60-3106f5b1d025

> now if i
> 
> 	; ip/ping /net.alt/icmp!12.51.113.7!0
> 
> i usually get one packet back and snoopy reports

there are surely more packets than that.
for example, where are the arp packets that initially
discover that 12.51.113.7 is 0030488ef4fb?

i suspect that the machine is sending out an arp request
for 12.51.113.7 and getting back responses both from
the actual 12.51.113.7 as well as the 65 gateway.  
the 65 gateway responds a little bit later, so that you 
manage to get one ping off between getting the first
response and the second response.  if this is the case,
then your 65 gateway is wrong.

alternately, it could be that the 65 gateway is somehow
getting the ping traffic and responding with a 
"no route to host" and somehow that response is
poisoning the arp cache.  

snoopy -f 'icmp || arp' would tell for sure.
it would also be nice to see the output of netstat -i.

russ