I have a Redhat 7.0 machine that I'm having some kind of routing problem or something with. This machine is used to monitor our routers.

The symptoms are as follows:
I can ping the router. When the router goes down, I cannot ping it (obviously). When the router comes back up, I still cannot ping it. After a few hours the problem seems to fix itself.

Oddly, this does not happen every time. I cannot figure out a pattern. The default route (0.0.0.0) is set to our gateway (a router). If I reboot the machine or add a static route to the router I can then ping it. No other Windows, UNIX, or Linux machines on the network are having this problem. Perhaps this is an arp problem? 'arp -a' does not show any of these problematic addresses. I even upgraded the kernel to 2.4 with no luck.

TIA
...Kevin

I have no idea about your problem but I find it very interesting and would like to notified if someone does.

I wouldn't blame ARP it clears its cache every 3 mins or so, so if it loses its router path then no ARP info is held until a ARP whois request is make on network

Next time if happens run TCPDUMP in a new window and try and ping the router.
Post the info it shows you and I'll tell you what it thinks has happened.

/Raz

An idea, which may lead be way off base or could lead to something. Are you using DHCP? Is it possible that the previous DHCP info must expire and the PC request new DHCP info before you can see the router?

First, let me say, that this is a "math" problem so to speak and you have 3 unknowns and only 2 equations. What I mean is, if you haven't "found a pattern" then I am quite sure you are missing some very important part of the equation.

You say this is the only machine doing it?
Are there any other denominators? Does this system have a different kind of NIC than the other machines? Is it connected to a different switch? Are there any additional hubs or switches in its path to the router that the other machines don't have? Is it on a the same sub set as some other identical machines that this doesn't occur on?
Is this machine running a kernel, app, or distro that no other machine is running?

I got pretty drastic as I need to have this functioning as soon as possible. I wiped out Redhat and loaded OpenBSD 2.8. Same problem occurs. I moved the network cable from our switch to a hub and set the NIC for 10BaseT (as opposed to autoselect). Same problem.

TCPDUMP didn't seem to produce anything from a specific ping. The machine is running Big Brother (Network monitoring software) which the others do not.

What I finally discovered is that when these problems occur and I run 'netstat -rn' I see that the default gateway for the route to the router is set to our firewall (which is incorrect). I did not add these routes manually so I don't know why this is occurring. If I delete the route, then it's fine.

Still not sure what's causing this. ?

Kliquori,

If you haven't put the firewalls IP address in any of scripts for building the routing FIB tables, then it could be that your Redhat/BSD box has been told by the firewall or another router on that subnet that the firewall is a router. Something is sending a multicast router advertisement query.

If you want to see this is the case, packet sniff for any packets from the subnet to a multicast address of 224.0.0.1, sending ICMP type 9 messages. (routers do this every 7 to 10 mins)

Then the problem is either the firewall thinks its a router or another router thinks the firewall is a router and likes
to info everyone via the router discovery protocol.

just an idea.
/Raz