Ghost IP addresses found in all the access routers in a region

[rao.machavarapu]

I am getting the Ghost IPs when I run a " Sh ARP" command . I have attached the sample output .

Thanks

[jgervia_2]

Hello,

You are only going to get arp entries for locally attached hosts that you are sending frames to or receiving frames from. If you were receiving frames from those hosts, you'd actually have arp entries for them.

What is most likely happening is that traffic is going through your router destined for those hosts. The router arps for them (so it can send them the frame), doesn't receive a reply, and that is how you get the 'incomplete' in the router's arp table.

Now, if there aren't actually hosts out there on those IP addreses, either someone has misconfigured some applications with incorrect IP addresses, or potentially there is a network scan occuring trying to find what hosts are out on that network. Either way, some traffic is destined to those IP addresses .

Of course, if there are hosts out there, and you have incomplete arp entries, you may have some network issue.

--Jason

Please rate if this helps.

[rao.machavarapu]

Jason, thanks for your reply.

I think it is a virus and it is generating some traffic destined to those IP addresses which does not exists. I don't see any Virus traffic coming into routers to filter the traffic. I want a solution from some one who come across this situation. Plese regrett if this assumption is wrong.

Thankyou

[jgervia_2]

Hi,

You might want to start a new topic with 'how to stop virus traffic' or something on a router - though I can tell you that most of the responses to that are going to involve IPS, IDS, or something other than a router.

--Jason

Please rate my message if it helped resolve the issue.

[rao.machavarapu]

Thanks for your reply Jason.

I am happy with your answer. But I don't understand what is the application causing for this problem.

Thanks