Incomplete ARP entries:

[dinekal]

Hi,

We've a Cisco 7206 router FastEthernet connnected to Catalyst 5505 switch.Nowdays I used to see lot of arp traffic in my network and making "INCOMPLETE ARP ENTRIES" in my router arp cache.

Can any of you guys tell why I get incomplete arp entries at my router and whar would be source of this kind of issues?

The "debug arp" command output follows (here 10.1.207.1 IP is my router fastethernet, and other IPs are not used in the network)

Aug 22 13:02:18: IP ARP: sent req src 10.1.207.1 00b0.c2a8.0000,

dst 10.1.207.24 0000.0000.0000 FastEthernet0/0/0

Aug 22 13:02:18: IP ARP: sent req src 10.1.207.1 00b0.c2a8.0000,

dst 10.1.207.25 0000.0000.0000 FastEthernet0/0/0

Aug 22 13:02:18: IP ARP: sent req src 10.1.207.1 00b0.c2a8.0000,

dst 10.1.207.26 0000.0000.0000 FastEthernet0/0/0

Aug 22 13:02:18: IP ARP: sent req src 10.1.207.1 00b0.c2a8.0000,

dst 10.1.207.27 0000.0000.0000 FastEthernet0/0/0

Aug 22 13:02:18: IP ARP: sent req src 10.1.207.1 00b0.c2a8.0000,

dst 10.1.207.28 0000.0000.0000 FastEthernet0/0/0

Thanks,

Dinesh.K

[mark-obrien]

Dinesh,

This means that the router never got a response to the ARP request. Are you sure that the address exists in the same VLAN as the router?

Mark

[Prashanth Krishnappa]

Lot of incomplete ARP entries is one of the signatures of one of the variants of Microsoft BLASTER/Nachi virus which has been going around for the past week or so.

http://www.cisco.com/warp/public/707/advisory.html