Invalid Mac address

[alain.desnoyers]

We have mail servers that are connected to Cisco 4006 switches. Some servers seem to loose connectivity to each other within the subnet. Only cetain servers are affected. When we issue the arp -a command on one of the affected servers, we see invalid mac entries for the same list of ip addresses. These invalid MACs appear and disappear and are listed as 00-00-00-00-00-00. From the server that showed invalid MACs, we had intermittent connectivty problems to other servers on the subnet, this server seems to be the only one that has these invalid MACs in its table. Could it be the server itself, or the other server whose MACs are reported as 00-00-00-00-00-00. Our Optiview probe showed that the server that has the invalid MACs in its table was one of the top talkers in the subnet, at times topping our routers. A host on a single subnet should not be arping that much. Any comments , What would cause an ARP storm?

[DALE FRANCIS]

The invalid MAC entries on the server are un-resovled ARP entries or address's that have had no ARP replies.

ARP'ing alot on a subnet is very common, this depends on the APP's running on servers etc. You seem to have some issue with your IP stack on that machine or an APP that is requesting this information.

Basically, you either have an issue with WINSOCK or you have an APP on that server that is requesting IP information and thus sending out loads of ARP's, my adive would be to analyse the segment, and make sure you are getting ARP replies, if the server is requesting INVALID ARP's (One's with bogus IP's) then that is defs an APP on the server.

[alain.desnoyers]

Thanks for your response, the server is requesting ARPs for valid Ip addreses but receives 00-00-00-00-00-00 . The Ip address with that invalid MAC will eventually disappear from the arp table on that server, and then reappear with the proper MAC.

Thanks