SVI Broadcast ARP

[Mhon Baul]

Hi All,

I've tried to run a wireshark and i noticed that there is one host that sending broadcast arp. When i find which device it is, i found out that its the mac-address of the SVI interface of Core_Switch. Is this normal? Any suggestion is much appreciated.

Many Thanks,

Reymon

[Laurent Aubert]

Hi Reymon,

It's expected the switch sends ARP request if it needs to route traffic to host locally connected and their MAC-address are still unknown.

HTH

Laurent.

[Mhon Baul]

Hi Laurent,

Thanks for your fast response. I attached here the picture that i've sniff. I'm still confused.

Many Thanks,

reymon

[Laurent Aubert]

Are all those IP addresses reachable ?

You could also sniff the IP packets the switch is receiving and see who wants to reach those addresses.

HTH

Laurent.

[Mhon Baul]

Yes,all of these IP's are reachables. How can i sniff the packets, is there something i need to config on the wireshark. thanks in advance!

regards,

reymon

[Laurent Aubert]

You could connect your PC running wireshark on a dedicated port and use the span feature to have a copy of each IP packets received from any L3 interfaces except the one where there are the ARP request

http://www.cisco.com/en/US/docs/switches/lan/catalyst6500/ios/12.2SX/configuration/guide/span.html#wp1089465

Laurent.