gratuitous ARP?

[ahurtadove]

Hi everyone,I was wondering if any of you could help me with this... I work in a telecom and they have a 2600 Router with an "old" image (12.1) and I'm having trouble with it because sometimes I loose connection with the LAN. This debug arp messages show something interesting and I don't actually know if I'm aiming at the right direction.

.Mar 18 20:45:18: IP ARP: sent req src XXX.XX.XX.230 0006.281e.dc60,dst XXX.XX.XX.235 0022.90c1.e035 FastEthernet0/0

.Mar 18 20:45:18: IP ARP: sent req src XXX.XX.XX.230 0006.281e.dc60,dst XXX.XX.XX.232 0004.9ae1.b3e0 FastEthernet0/0

.Mar 18 20:45:18: IP ARP: sent req src XXX.XX.XX.230 0006.281e.dc60,dst XXX.XX.XX.233 0006.281e.e220 FastEthernet0/0

.Mar 18 20:45:18: IP ARP: sent req src XXX.XX.XX.230 0006.281e.dc60,dst XXX.XX.XX.228 00d0.bbd3.3980 FastEthernet0/0

.Mar 18 20:45:18: IP ARP: sent req src XXX.XX.XX.230 0006.281e.dc60,dst XXX.XX.XX.252 0021.5ad7.4f32 FastEthernet0/0.

.Mar 18 20:45:18: IP ARP: sent req src XXX.XX.XX.230 0006.281e.dc60,dst XXX.XX.XX.242 0000.cd08.4e21 FastEthernet0/0

.Mar 18 20:45:18: IP ARP: sent req src XXX.XX.XX.230 0006.281e.dc60,dst XXX.XX.XX.244 00a0.8eb3.aa39 FastEthernet0/0

.Mar 18 20:45:18: IP ARP: sent req src XXX.XX.XX.230 0006.281e.dc60,dst XXX.XX.XX.245 0000.5e00.0114 FastEthernet0/0

.Mar 18 20:45:18: IP ARP: sent rep src XXX.XX.XX.230 0006.281e.dc60,dst XXX.XX.XX.230 ffff.ffff.ffff FastEthernet0/0

.Mar 18 20:45:18: IP ARP: sent rep src XXX.XX.XX.230 0000.0c07.ace5,dst XXX.XX.XX.229 ffff.ffff.ffff FastEthernet0/0

.Mar 18 20:45:18: IP ARP: sent rep src XXX.XX.XX.230 0000.0c07.ace5,dst XXX.XX.XX.229 0100.0ccd.cdcd FastEthernet0/0

.Mar 18 20:45:18: IP ARP: sent rep src XX.XX.XX.249 0006.281e.dc60,dst XXX.XX.XX.249 ffff.ffff.ffff FastEthernet0/0

WHY IS THIS IP ADDRESS RELATED TO THE MAC ADDRESS OF THE ROUTER'S INTERFACE?

IS THIS GRATUITOUS ARP??

I know this kind of packets have the same ip address in the source and destination fields and they are a broadcast but how come the ip address XXX.XX.XX.249 has a mac address 0006.281e.dc60 when that's the MAC of the router's interface

I'm kinda tired of looking up in google and not having an answer to this but I know you guys are gonna help me.

Thanks in advance

Antonio Hurtado

[Giuseppe Larosa]

Hello Antonio,

we should see

sh ip interface fas0/0

to see if proxy ARP is enabled

my impression is that this could be an example of proxy ARP rather then a gratuitous ARP.

is the masked ip address out of the IP subnet or in the same IP subnet as router interface ip address?

Hope to help

Giuseppe

[ahurtadove]

Nope, proxy-arp is not active in the interface.

I guess it is gratuitous just because of the characteristics of the packet, same addresses in both fields, and broadcast...

[Tharak Abraham]

Antonio,

That is a Gratuitious Arp undoubtfully !

Is .230 your interface ip ? and Is this a virtual ip or something for vrrp ?

A gratuitious arp reply is a tough one to look into !

I believe this will happen in scenes of high availability solutions.

You need to analyse more deeply IMHO !