Solved: Incomplete ARP

danny9797 · ‎10-13-2007

Hi all,

What can cause incomplete arp table for a fast ethernet connection on a cisco router? If the device connected to the cisco is connected but power off or in standby, would cisco issue an incomplete arp or would it remove the arp from the table completely?

Thanks

Richard Burts · ‎10-13-2007

Dan

Perhaps there is something in your question that I do not completely understand. So let me explain a bit and if it does not answer your issue then you can clarify so that I understand it better.

When Cisco generates an ARP request it builds an entry in the ARP table that is "incomplete". If it receives a response with a MAC address then it rewrites the incomplete entry as a normal entry with an IP address and a MAC. If it does not receive a response it maintains the incomplete entry for a little while (hoping that it will receive a response) and then it removes the entry.

So if there is some device that is physically connected but is not active (does not respond to the ARP request) then I would expect to see an incomplete entry for a short amount of time and then to see the entry removed.

If this does not address your issue then please clarify so that I understand it better.

[edit] Kevin I see that you have also responded with a similar response. There is one thing I would like to clarify in your response. You seem to say that after 4 hours the ARP entry is removed and it waits for the next packet to that destination to renew the ARP entry. Actually what happens is that the Cisco will remove the entry and will immediately send an ARP request to the address. If the device is still on line it will respond and an entry will be placed in the ARP table. If the device is off line then no entry is created in the table. So it is not dependent on another packet. It is easy to check this: go to a Cisco device, check the ARP table, do a clear arp, and check the table again. It should have the same content (or very near to the same content) showing that it does not wait for another data packet to the destination. Or an even better test would be to turn on debug arp and then clear the arp table. You would clearly see the Cisco generating ARP requests for every entry in the table.

HTH

Rick

HTH

Rick

View solution in original post

Kevin Dorrell · ‎10-13-2007

If you see "Incomplete" against an entry in the ARP table, it means that the router has issued an ARP request and has not had a response. These entries get cleared out after a time.

Resolved entries stay in the ARP table for the ARP aging time, 4 hours by default. That is independent of whether the host is active, switched off, whatever. The entry, once established, will remain there for 4 hours. After 4 hours it will be deleted (even if the host is active) and the next packet for that host will provoke an ARP request.

This behavior is completely different from the behavior of the MAC forwarding table in a switch, which is entirely a different thing, and should not be confused with an ARP.

Kevin Dorrell

Luxembourg

Kevin Dorrell

Luxembourg

Richard Burts · ‎10-13-2007

Dan

Perhaps there is something in your question that I do not completely understand. So let me explain a bit and if it does not answer your issue then you can clarify so that I understand it better.

When Cisco generates an ARP request it builds an entry in the ARP table that is "incomplete". If it receives a response with a MAC address then it rewrites the incomplete entry as a normal entry with an IP address and a MAC. If it does not receive a response it maintains the incomplete entry for a little while (hoping that it will receive a response) and then it removes the entry.

So if there is some device that is physically connected but is not active (does not respond to the ARP request) then I would expect to see an incomplete entry for a short amount of time and then to see the entry removed.

If this does not address your issue then please clarify so that I understand it better.

[edit] Kevin I see that you have also responded with a similar response. There is one thing I would like to clarify in your response. You seem to say that after 4 hours the ARP entry is removed and it waits for the next packet to that destination to renew the ARP entry. Actually what happens is that the Cisco will remove the entry and will immediately send an ARP request to the address. If the device is still on line it will respond and an entry will be placed in the ARP table. If the device is off line then no entry is created in the table. So it is not dependent on another packet. It is easy to check this: go to a Cisco device, check the ARP table, do a clear arp, and check the table again. It should have the same content (or very near to the same content) showing that it does not wait for another data packet to the destination. Or an even better test would be to turn on debug arp and then clear the arp table. You would clearly see the Cisco generating ARP requests for every entry in the table.

HTH

Rick

HTH

Rick

Zain Khan · ‎06-01-2020

This reason most likely come due to Two major reason

1. Incomplete Subnet mask

One you must check subnet mask of given IP.. if the IP belongs to given IP pool but its subnet mask is more likely given wrong. Make sure its subnet mask is as configure as on its gateway device

2. Proxy ARP..

Proxy arp needs to enable on Exit interface of the router or gateway device because this reason mostly comes when 2 public IP configured on two LAN devices from one router and both devices acts itself a gateway for internet. In this case the router doesnt know which part should be consider its LAN part whether the device one or second. in this case you needs to enable Proxy ARP command on router exit interface so that it can learn complete ARP from both the interfaces and can able to consider both are its LAN parts

Zain Khan
https://www.linkedin.com/in/forzain/