ARP Incomplete Entries.

losdelrock · ‎10-07-2005

Hello, we are seeing continuous ARP Incomplete entries (using debug ARP) which are not getting deleted on our Cisco 3640 internal interface, they are never deleted. I would appreciate any help on understanding why these requests are being made and how to stop them.

Thanks!

spremkumar · ‎10-07-2005

hi

did u try clearing arp ? whts the ios code you are running in your box at present ?

usually incomplete entries points the unreachability to that particular ip which is displayed out there.

try to find out whether those incomplete entries belongs to your local subnet or different subnet altogether also if they belongs to the same local subnet then try to find out whether they are powered on.

Also would suggest to check out for any known worms or virus variants in your network which may also be a possible reason for this ..

you can do this using ip route-cache flow under the lan interface and use show ip cache flow to find out the traffic patterns getting traversed which can clear up most of the things.

regds

dbellaze · ‎10-07-2005

If the router is attempting to route a packet to a desitionation it doesn't have an ARP entry for it will ARP for it. If the host doesn't exist it will just create an incomplete entry. Depending on how often it does this it might look like its never timing them out.

If your wide open to the internet using public IP's on your LAN port scanners could cause this type of thing.

Daniel

losdelrock · ‎10-07-2005

Thanks to both of you - I will get on it on Monday. How do I make sense of the route-cache flow to see if it is a worm or port scan? The offending ARPs are coming from our internal interface, and you are right, our router is open to the world.

Adrian

losdelrock · ‎10-10-2005

Hello - further to the above topic, is it possible to gather stats over time for the ip cache flow command using SNMP or other method? Thanks!

spremkumar · ‎10-10-2005

hi

The ip cache flow commands displays you the o/p which will have both input and output port numbers of the active traffic transactions being carried out by the routers.

Those values will be in hexa values which u can convert to normal decimal , you match out the same with the port numbers being used by the usual worms,virus or their variants.

regds

losdelrock · ‎10-11-2005

Thanks - is there any way I can gather stats over time for this - e.g. SNMP? Sitting at a console pressing "ip cache flow" all the time does not appeal to me. We use a brilliant SNMP/RMON package called OpManager which can pull stats off almost anything, just wondering if Cisco's MIB has the ip cache flow in it somewhere...

Adrian.