03-25-2010 07:45 AM - edited 03-06-2019 10:18 AM
Hi everyone,I was wondering if any of you could help me with this... I work in a telecom and they have a 2600 Router with an "old" image (12.1) and I'm having trouble with it because sometimes I loose connection with the LAN. This debug arp messages show something interesting and I don't actually know if I'm aiming at the right direction.
.Mar 18 20:45:18: IP ARP: sent req src XXX.XX.XX.230 0006.281e.dc60,dst XXX.XX.XX.235 0022.90c1.e035 FastEthernet0/0
.Mar 18 20:45:18: IP ARP: sent req src XXX.XX.XX.230 0006.281e.dc60,dst XXX.XX.XX.232 0004.9ae1.b3e0 FastEthernet0/0
.Mar 18 20:45:18: IP ARP: sent req src XXX.XX.XX.230 0006.281e.dc60,dst XXX.XX.XX.233 0006.281e.e220 FastEthernet0/0
.Mar 18 20:45:18: IP ARP: sent req src XXX.XX.XX.230 0006.281e.dc60,dst XXX.XX.XX.228 00d0.bbd3.3980 FastEthernet0/0
.Mar 18 20:45:18: IP ARP: sent req src XXX.XX.XX.230 0006.281e.dc60,dst XXX.XX.XX.252 0021.5ad7.4f32 FastEthernet0/0.
.Mar 18 20:45:18: IP ARP: sent req src XXX.XX.XX.230 0006.281e.dc60,dst XXX.XX.XX.242 0000.cd08.4e21 FastEthernet0/0
.Mar 18 20:45:18: IP ARP: sent req src XXX.XX.XX.230 0006.281e.dc60,dst XXX.XX.XX.244 00a0.8eb3.aa39 FastEthernet0/0
.Mar 18 20:45:18: IP ARP: sent req src XXX.XX.XX.230 0006.281e.dc60,dst XXX.XX.XX.245 0000.5e00.0114 FastEthernet0/0
.Mar 18 20:45:18: IP ARP: sent rep src XXX.XX.XX.230 0006.281e.dc60,dst XXX.XX.XX.230 ffff.ffff.ffff FastEthernet0/0
.Mar 18 20:45:18: IP ARP: sent rep src XXX.XX.XX.230 0000.0c07.ace5,dst XXX.XX.XX.229 ffff.ffff.ffff FastEthernet0/0
.Mar 18 20:45:18: IP ARP: sent rep src XXX.XX.XX.230 0000.0c07.ace5,dst XXX.XX.XX.229 0100.0ccd.cdcd FastEthernet0/0
.Mar 18 20:45:18: IP ARP: sent rep src XX.XX.XX.249 0006.281e.dc60,dst XXX.XX.XX.249 ffff.ffff.ffff FastEthernet0/0
WHY IS THIS IP ADDRESS RELATED TO THE MAC ADDRESS OF THE ROUTER'S INTERFACE?
IS THIS GRATUITOUS ARP??
I know this kind of packets have the same ip address in the source and destination fields and they are a broadcast but how come the ip address XXX.XX.XX.249 has a mac address 0006.281e.dc60 when that's the MAC of the router's interface
I'm kinda tired of looking up in google and not having an answer to this but I know you guys are gonna help me.
Thanks in advance
Antonio Hurtado
03-25-2010 10:58 AM
Hello Antonio,
we should see
sh ip interface fas0/0
to see if proxy ARP is enabled
my impression is that this could be an example of proxy ARP rather then a gratuitous ARP.
is the masked ip address out of the IP subnet or in the same IP subnet as router interface ip address?
Hope to help
Giuseppe
03-25-2010 11:44 AM
Nope, proxy-arp is not active in the interface.
I guess it is gratuitous just because of the characteristics of the packet, same addresses in both fields, and broadcast...
03-25-2010 09:52 PM
Antonio,
That is a Gratuitious Arp undoubtfully !
Is .230 your interface ip ? and Is this a virtual ip or something for vrrp ?
A gratuitious arp reply is a tough one to look into !
I believe this will happen in scenes of high availability solutions.
You need to analyse more deeply IMHO !
Find answers to your questions by entering keywords or phrases in the Search bar above. New here? Use these resources to familiarize yourself with the community: