mysterious arp entries

[f.fnlaspect]

When a 'show arp' is issued there are numerous entries with ip address and 'incomplete' hardware addresses. No response is given to the ip address from a ping. After a 'clear arp' and then a 'show arp' is then performed, the entry comes back immediately as 'incomplete' , where are these entries coming from? Anyone have any ideas?

[uniemeyer]

Hi,

the incomplete message, I am sure you already know, is due to a host doesn't respond to an arp request.

If you clear the arp cache the cisco router doesn't simply delete the entries.

Instead it sends again arp requests for all entries in the table and should

delete the one which not respond or were incomplete. However, you

can discover what's up by enabling "debug arp". So, either your router

behaves not like it should or it could be that someone is scanning your

network for IP addresses, i.e network monitoring tools do that or a "virus"

software.

!! be careful, when enabling the "debug" command, it can be very performance eating!! Maybe you can use an protocol analyser.

regards Ulrich Marzoli

www.netaid.de

[f.fnlaspect]

Thanks Ulrich,

I think there must be something wrong with the router. There is no-one on this site and its always been like this.

Thanks again, Lee.

[deilert]

What is happening here is some one is trying to access these ip addresses. When they packet hits the router, if the router does not have an entry in arp it will arp for the mac address. When it receives no reponse from the host the arp entry is listed as incomplete. This could be caused by faulty hardware on the segment or the hosts could be powered off.