Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
Announcements
Webcast-Catalyst9k
New Member

%ARP-3-INVAL_HDR

Hi,

we are getting these logs on Nexus 7010. How can we find the device that causing this problem?

2012 Jun  1 17:26:09 

%ARP-3-INVAL_HDR

:  arp [5793]  Found incorrect hardware/protocol

type in ARP header: 6/2048

2012 Jun  1 17:28:00  last message repeated 2 times

2012 Jun  1 17:29:04  last message repeated 3 times

2012 Jun  1 17:40:08  last message repeated 1 time

2012 Jun  1 17:41:12  last message repeated 3 times

3 REPLIES
Cisco Employee

Re: %ARP-3-INVAL_HDR

Hi,

It seems that for this packet Hardware Type is wrong at 6  (it should be 1 for Ethernet), while Protocol Type 2048 is correct for IP. 

You can span the inband port or enable ethanalyzer, and when this error happens, and stop the inband span or the ethanlayzer, and find the

source of the device.

N7K1# ethanalyzer local interface inband capture-filter "arp" write bootflash:arp.pcap (this will create a Wireshark file on bootflash which

you can tftp off of the switch and open it in Wireshark).

The time must match, meaning you need to stop the capture (Ctrl + C) as soon as you see the invalid ARP error message. You will need to open

second telnet session to switch to monitor show log for the error message.

Kind Regards,

Ivan

**Please grade this post if you find it useful.

Kind Regards, Ivan Shirshin **Please grade this post if you find it useful.
New Member

Re: %ARP-3-INVAL_HDR

I have done that. I am able to get 10 packets only.. can i limit for 10 mb for example..?

New Member

Re: %ARP-3-INVAL_HDR

Hi,

I am checking like this:

NX1# ethanalyzer local interface inband capture-filter "arp"  limit-captured-frames 1000 detail  | i Hardware|Src

Capturing on inband

Ethernet II, Src: 00:50:56:9b:00:3f (00:50:56:9b:00:3f), Dst: ff:ff:ff:ff:ff:ff (ff:ff:ff:ff:ff:ff)

    Hardware type: Ethernet (0x0001)

    Hardware size: 6

Ethernet II, Src: 00:09:6b:58:46:f3 (00:09:6b:58:46:f3), Dst: ff:ff:ff:ff:ff:ff (ff:ff:ff:ff:ff:ff)

    Hardware type: Ethernet (0x0001)

    Hardware size: 6

Ethernet II, Src: 00:09:6b:58:46:f3 (00:09:6b:58:46:f3), Dst: ff:ff:ff:ff:ff:ff (ff:ff:ff:ff:ff:ff)

    Hardware type: Ethernet (0x0001)

    Hardware size: 6

Ethernet II, Src: 00:50:56:9b:00:3f (00:50:56:9b:00:3f), Dst: ff:ff:ff:ff:ff:ff (ff:ff:ff:ff:ff:ff)

    Hardware type: Ethernet (0x0001)

    Hardware size: 6

Ethernet II, Src: 68:b5:99:72:6a:42 (68:b5:99:72:6a:42), Dst: 00:00:0c:07:ac:21 (00:00:0c:07:ac:21)

    Hardware type: Ethernet (0x0001)

    Hardware size: 6

Ethernet II, Src: 40:55:39:24:2d:42 (40:55:39:24:2d:42), Dst: 68:b5:99:72:6a:42 (68:b5:99:72:6a:42)

    Hardware type: Ethernet (0x0001)

    Hardware size: 6

Ethernet II, Src: 00:50:56:9b:00:34 (00:50:56:9b:00:34), Dst: ff:ff:ff:ff:ff:ff (ff:ff:ff:ff:ff:ff)

    Hardware type: Ethernet (0x0001)

    Hardware size: 6

Ethernet II, Src: 40:55:39:24:22:42 (40:55:39:24:22:42), Dst: 40:55:39:24:2d:42 (40:55:39:24:2d:42)

    Hardware type: Ethernet (0x0001)

    Hardware size: 6

But there is no anormal ARP, I think Nexus discards these packets and does not show with ethereal...

2398
Views
0
Helpful
3
Replies
CreatePlease to create content