Note: This is an archival copy of Security Sun Alert 200497 as previously published on http://sunsolve.sun.com.|
Latest version of this security advisory is available from http://support.oracle.com as Sun Alert 1000375.1.
Solaris 9 Operating System
Solaris 7 Operating System
Solaris 8 Operating System
Date of Resolved Release
A system receiving a very large number of specific arp(7P) network packets (an "arp storm" or "arp hurricane") could cause the system to hang. These ARP packets could result from a remote privileged user implementing a Denial of Service (DoS) or from a misconfigured (or broken) router inadvertently sending the packets.
This issue can occur in the following releases:
The system will be unable to provide networked services, and an unusually heavy amount of ARP traffic will be observed on the network.
One way to verify a suspected flood of ARP packets to a specific Solaris system on the network is to run the following command as the "root" user (from another system on the same network segment):
# snoop -o <output-file> arp # snoop -i <output-file>
A large number of ARP broadcasts such as:
7 0.12578 123.456.0.22 -> (broadcast) ARP C Who is 123.456.0.254, 123.456.0.254 ? 15 0.10603 123.456.0.2 -> (broadcast) ARP C Who is 123.456.0.22, 123.456.0.22 ?
may indicate an ARP flood.
A temporary workaround would be to physically disconnect the affected segment from the system until the source can be determined, and the source of the flood of ARP packets stopped. Once the system stops processing the packet flood, the hang will no longer be in effect.
This issue is addressed in the following releases:
This solution has no attachment