Subject: Solaris and "aarp_rput someone using our address"

From: Thomas Tornblom <[email-masked]>
Date: Mon, 6 Mar 2000 23:15:21 +0100 (MET)

I installed a Sun SPARCprinter E, which really is an OEM Lexmark, a while ago.

I configured Appletalk on it and my Macs prints directly to it.

I have since been getting:

---
Mar  6 22:27:58 spiff ddp: NOTICE: aarp_rput someone using our address
Mar  6 22:27:58 spiff 
Mar  6 22:27:58 spiff ddp: NOTICE: aarp_rput someone using our address
Mar  6 22:27:58 spiff 
---

Apparently others are also seeing this.

Tonight I decided to check out why these are coming, and apparently the printer 
responds to the AARP request by sending the response to the AppleTalk multicast 
address, which is bad mojo IMO:

---
spiff:/usr/local/src (230)> at_snoop -v -i /tmp/snoop.out -p 71,72 | more
ETHER:  ----- Ether Header -----
ETHER:  
ETHER:  Packet 71 arrived at 22:27:58.39
ETHER:  Packet size = 50 bytes
ETHER:  Destination = 9:0:7:ff:ff:ff, (multicast)
ETHER:  Source      = 0:5:2:ad:6:24, 
ETHER:  IEEE 802.3 length = 36 bytes
ETHER:  Ethertype = 80F3 (AARP (Appletalk))
ETHER:  
AARP: ----- AARP Frame -----
AARP: 
AARP: Hardware type = 1
AARP: Protocol type = 809B (EtherTalk (AppleTalk over Ethernet))
AARP: Length of hardware address = 6 bytes
AARP: Length of protocol address = 4 bytes
AARP: Opcode 1 (AARP Request)
AARP: Sender's hardware address = 0:5:2:ad:6:24
AARP: Sender's protocol address = 65280.173
AARP: Target hardware address = ?
AARP: Target protocol address = 43690.1
AARP: 

ETHER:  ----- Ether Header -----
ETHER:  
ETHER:  Packet 72 arrived at 22:27:58.42
ETHER:  Packet size = 50 bytes
ETHER:  Destination = 9:0:7:ff:ff:ff, (multicast)
----------------------^^^^^^^^^^^^^^ Stupid, should be sent to 0:5:2:ad:6:24
ETHER:  Source      = 0:4:0:20:b4:13, 
ETHER:  IEEE 802.3 length = 36 bytes
ETHER:  Ethertype = 80F3 (AARP (Appletalk))
ETHER:  
AARP: ----- AARP Frame -----
AARP: 
AARP: Hardware type = 1
AARP: Protocol type = 809B (EtherTalk (AppleTalk over Ethernet))
AARP: Length of hardware address = 6 bytes
AARP: Length of protocol address = 4 bytes
AARP: Opcode 2 (AARP Reply)
AARP: Sender's hardware address = 0:4:0:20:b4:13
AARP: Sender's protocol address = 43690.1
AARP: Target hardware address = 0:5:2:ad:6:24
AARP: Target protocol address = 65280.173
AARP: 
---

netatalk of course listens to this multicast address, and "aarp_rput" decides 
that someone is using the Suns address as it sees a response to a request it 
didn't send.

It should be pretty easy for someone who knows their way through the solaris 
netatalk kernel module to add a check and only print out the message if the 
destination address is *not* the AppleTalk multicast address.

I have just commented out the warning for now.

Real life:      Thomas Törnblom             Email:  [email-masked]
Snail mail:     HB Hax                      Phone:    +46  18 290 290
                Banvallsvägen 14            Fax:      +46  18 290 291
                S - 754 40 Uppsala, Sweden  Cellular: +46  70 723 9172