Broadcast Address on 3

[David Herron -- One of the vertebrae]

AG!

No .. AT&T customer support is wrong -- the IP version of the broadcast
address won't "always" be 0.0.0.0 !!

What's going on here is that originally the TCP/IP suite didn't support
the broadcast address notion.  Then a bunch of software started doing
it, probably because of Berkeley but I don't know that fer sher.  And
they were using [0.0.0.0] or [<net>.0.0] as the broadcast address.

Sometime later some people wrote an RFC on the subject, sorry I don't
remember the name of the RFC, and decided it should be all-one's instead
of all 0's.  (thus [255.255.255.255] or [<net>.255.255])

BUT -- the kicker is that if you have old software in your network
you will be unable to tell that software what the proper broadcast
address is.  If you have some machines believing the all-0's and others
believing the all-1's version there will be confusion.

The ones believing the all-1's will be OK because they're also smart enough
to recognize the all-0's as an older form.

The ones believing the all-0's won't recognize the all-1's address
though.  Instead they'll receive this packet (since it's addressed to
the ether-level broadcast address it'll be accepted by the software/hardware).
Then it filters on down into the TCP/IP part of the system which knows
that [<net>.255.255] isn't its own IP address and neither is it the
broadcast address.  Usually these machines will try then to forward this
packet on to the proper place ... but it doesn't know where.

The proper thing to do on an ethernet when you don't have the ether address
corresponding to an IP address is to ask the net for it via ARP.  So ..
that's what these machines end up doing, ARPing for the all-1's broadcast.
And since ARP is itself a broadcast all the machines on the net will receive
the query -- but nobody will respond.

Since most of the broadcast activity on a net is rwho stuff there will be
a lot of tightly coordinated ARPing going on immediately following each
and every rwho packet.  Depending on how many machines you have this can
kill your network.  On the other hand we survived for awhile with about
10 machines ARPing like this on our own network for many months, before I
stumbled across it while debugging something else.

BTW ... this effect is called a Broadcast Storm.

-- 
<- David Herron; an MMDF guy                              <david at ms.uky.edu>
<- ska: David le casse\*'      {rutgers,uunet}!ukma!david, david at UKMA.BITNET
<- By all accounts, Cyprus (or was it Crete?) was covered with trees at one time
<- 		-- Until they discovered Bronze