Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
New Member

SVI Broadcast ARP

Hi All,

I've tried to run a wireshark and i noticed that there is one host that sending broadcast arp. When i find which device it is, i found out that its the mac-address of the SVI interface of Core_Switch. Is this normal? Any suggestion is much appreciated.

Many Thanks,

Reymon

5 REPLIES
Cisco Employee

Re: SVI Broadcast ARP

Hi Reymon,

It's expected the switch sends ARP request if it needs to route traffic to host locally connected and their MAC-address are still unknown.

HTH

Laurent.

New Member

Re: SVI Broadcast ARP

Hi Laurent,

Thanks for your fast response. I attached here the picture that i've sniff. I'm still confused.

Many Thanks,

reymon

Cisco Employee

Re: SVI Broadcast ARP

Are all those IP addresses reachable ?

You could also sniff the IP packets the switch is receiving and see who wants to reach those addresses.

HTH

Laurent.

New Member

Re: SVI Broadcast ARP

Yes,all of these IP's are reachables. How can i sniff the packets, is there something i need to config on the wireshark. thanks in advance!

regards,

reymon

Cisco Employee

Re: SVI Broadcast ARP

You could connect your PC running wireshark on a dedicated port and use the span feature to have a copy of each IP packets received from any L3 interfaces except the one where there are the ARP request

http://www.cisco.com/en/US/docs/switches/lan/catalyst6500/ios/12.2SX/configuration/guide/span.html#wp1089465

Laurent.

299
Views
0
Helpful
5
Replies
CreatePlease to create content