Incomplete ARP

Endorsed Question
Oct 13th, 2007
User Badges:

Hi all,


What can cause incomplete arp table for a fast ethernet connection on a cisco router? If the device connected to the cisco is connected but power off or in standby, would cisco issue an incomplete arp or would it remove the arp from the table completely?


Thanks

Cisco Endorsed by usultan
Richard Burts about 9 years 7 months ago

Dan


Perhaps there is something in your question that I do not completely understand. So let me explain a bit and if it does not answer your issue then you can clarify so that I understand it better.


When Cisco generates an ARP request it builds an entry in the ARP table that is "incomplete". If it receives a response with a MAC address then it rewrites the incomplete entry as a normal entry with an IP address and a MAC. If it does not receive a response it maintains the incomplete entry for a little while (hoping that it will receive a response) and then it removes the entry.


So if there is some device that is physically connected but is not active (does not respond to the ARP request) then I would expect to see an incomplete entry for a short amount of time and then to see the entry removed.


If this does not address your issue then please clarify so that I understand it better.


[edit] Kevin I see that you have also responded with a similar response. There is one thing I would like to clarify in your response. You seem to say that after 4 hours the ARP entry is removed and it waits for the next packet to that destination to renew the ARP entry. Actually what happens is that the Cisco will remove the entry and will immediately send an ARP request to the address. If the device is still on line it will respond and an entry will be placed in the ARP table. If the device is off line then no entry is created in the table. So it is not dependent on another packet. It is easy to check this: go to a Cisco device, check the ARP table, do a clear arp, and check the table again. It should have the same content (or very near to the same content) showing that it does not wait for another data packet to the destination. Or an even better test would be to turn on debug arp and then clear the arp table. You would clearly see the Cisco generating ARP requests for every entry in the table.


HTH


Rick

  • 1
  • 2
  • 3
  • 4
  • 5
Overall Rating: 5 (1 ratings)
Loading.
Kevin Dorrell Sat, 10/13/2007 - 17:13
User Badges:
  • Green, 3000 points or more

If you see "Incomplete" against an entry in the ARP table, it means that the router has issued an ARP request and has not had a response. These entries get cleared out after a time.


Resolved entries stay in the ARP table for the ARP aging time, 4 hours by default. That is independent of whether the host is active, switched off, whatever. The entry, once established, will remain there for 4 hours. After 4 hours it will be deleted (even if the host is active) and the next packet for that host will provoke an ARP request.


This behavior is completely different from the behavior of the MAC forwarding table in a switch, which is entirely a different thing, and should not be confused with an ARP.


Kevin Dorrell

Luxembourg



Kevin Dorrell

Luxembourg

Richard Burts Sat, 10/13/2007 - 17:20
User Badges:
  • Super Silver, 17500 points or more
  • Hall of Fame,

    Founding Member

  • Cisco Designated VIP,

    2017 LAN, WAN

Dan


Perhaps there is something in your question that I do not completely understand. So let me explain a bit and if it does not answer your issue then you can clarify so that I understand it better.


When Cisco generates an ARP request it builds an entry in the ARP table that is "incomplete". If it receives a response with a MAC address then it rewrites the incomplete entry as a normal entry with an IP address and a MAC. If it does not receive a response it maintains the incomplete entry for a little while (hoping that it will receive a response) and then it removes the entry.


So if there is some device that is physically connected but is not active (does not respond to the ARP request) then I would expect to see an incomplete entry for a short amount of time and then to see the entry removed.


If this does not address your issue then please clarify so that I understand it better.


[edit] Kevin I see that you have also responded with a similar response. There is one thing I would like to clarify in your response. You seem to say that after 4 hours the ARP entry is removed and it waits for the next packet to that destination to renew the ARP entry. Actually what happens is that the Cisco will remove the entry and will immediately send an ARP request to the address. If the device is still on line it will respond and an entry will be placed in the ARP table. If the device is off line then no entry is created in the table. So it is not dependent on another packet. It is easy to check this: go to a Cisco device, check the ARP table, do a clear arp, and check the table again. It should have the same content (or very near to the same content) showing that it does not wait for another data packet to the destination. Or an even better test would be to turn on debug arp and then clear the arp table. You would clearly see the Cisco generating ARP requests for every entry in the table.


HTH


Rick

Actions

This Discussion