×

Warning message

  • Cisco Support Forums is in Read Only mode while the site is being migrated.
  • Cisco Support Forums is in Read Only mode while the site is being migrated.

Problem with ARP table

Unanswered Question
Aug 11th, 2003
User Badges:

Hi,


I have a Cisco 3640 series router with a one ethernet 10MBps interface and two Serial interfaces. When I see my ARP table with command show arp i see too much ip addresses of my network that arent in use an router mark this as incomplete, has any way that i can block this ... Thanks..


H.O.

  • 1
  • 2
  • 3
  • 4
  • 5
Overall Rating: 0 (0 ratings)
Loading.
prafuljaded Mon, 08/11/2003 - 15:43
User Badges:

You can clear arp entries using " clear arp" and check whether you still find incomplete entries.

rjackson Tue, 08/12/2003 - 06:19
User Badges:
  • Bronze, 100 points or more

That volume of incompletes indicates someone is scanning the network; pinging through the address range looking for hosts. This is common when you are setting up a network mapping tool. It pings through the address space then goes back to each host that answers and trys to get more info with snmp. The incomplete arp entries will age out in a couple of minutes but if the network dept is not doing the scan you should find and stop the culprit. They are gathering information about your network. Possibly its innocent, or the beginning of an attack.

Actions

This Discussion