Problem with ARP table

dian.it · ‎08-11-2003

Hi,

I have a Cisco 3640 series router with a one ethernet 10MBps interface and two Serial interfaces. When I see my ARP table with command show arp i see too much ip addresses of my network that arent in use an router mark this as incomplete, has any way that i can block this ... Thanks..

H.O.

prafuljaded · ‎08-11-2003

You can clear arp entries using " clear arp" and check whether you still find incomplete entries.

rjackson · ‎08-12-2003

That volume of incompletes indicates someone is scanning the network; pinging through the address range looking for hosts. This is common when you are setting up a network mapping tool. It pings through the address space then goes back to each host that answers and trys to get more info with snmp. The incomplete arp entries will age out in a couple of minutes but if the network dept is not doing the scan you should find and stop the culprit. They are gathering information about your network. Possibly its innocent, or the beginning of an attack.