11-17-2003 08:04 AM - edited 03-02-2019 11:46 AM
This site has only about 20 hosts yet its ARP table has thousands of entries. We normally don't generate traffic from the switch. Can anyone think of a reason why I have such large ARP table? Thanks,
11-17-2003 08:30 AM
do a "sh cam dynamic" and look at what is the port all these mac addresses are known from.
11-17-2003 08:32 AM
hritter,
That command is from 5500. I have 3500XL. Is there another similar command from 3500XL? Thanks,
11-17-2003 08:48 AM
The command on 3500 XL is
show mac-address-table
or the full format is
show mac-address-table [static | dynamic | secure | self | aging-time | count]
[address hw-addr] [interface interface] [atm slot/port] [vlan vlan-id]
11-17-2003 08:36 AM
Ok, I see it now. All these ARP entries are learned from the router. But why is the switch getting all these ARP entries from the router?
11-17-2003 06:46 PM
Possible that the management vlan interface is on the same vlan as the hosts. The switch will not purge the ARP entries as long as the hosts in the ARP table responds (gratuitous ARP sent 60 seconds prior to aging). Long term solution would be to move that mgmt intf to a non-user vlan.
11-18-2003 09:11 AM
Robho,
Yeah, the ARP table says it learns all that from the router, and yes it is on the same vlan as the management vlan. However, I compare with several other sites, I don't see any large ARP entries. So the issue is probably laying somewhere else.
11-18-2003 11:18 AM
Proxy-Arp? How are your subnets setup? Have you 'chunked' up your address space (possibly network 10.0.0.0/8?) but put the incorrect mask on the VLAN management interface?, hence proxy-arp responses by the router? (still not sure why you would have thousands of hosts wanting to talk to the switch though? maybe a virus and a ping-sweep from lots of infected hosts???).
Andy
11-18-2003 11:52 AM
The switch should only install the local ARP entry only if it had some type of conversation with all the hosts. Most likely, the router is sourcing these ARP's to the switch with the host's IP address OR, each of those hosts "spoke" to the switch. I'd suggest sniffing the mgmt intf, clearing the ARP table, and see what happens.
11-18-2003 01:38 PM
If the switch has its mask and gateway correctly defined it should not have arp entries for any hosts outside of its network. It uses the gateway to reach hosts outside.
Find answers to your questions by entering keywords or phrases in the Search bar above. New here? Use these resources to familiarize yourself with the community: