01-24-2007 06:42 AM - edited 03-03-2019 03:28 PM
Hi,
Just a quick one - what could cause incomplete MAC addresses in the ARP? I know that they can be caused if you try to reach an IP address which is currently not available because it is wrong, or the device with the assigned IP address is currently down or not connected. There are only a couple of incomplete MAC addresses - is this anything out of the ordinary?
Thanks in advance
Rob
01-24-2007 09:38 AM
Rob
My opinion is that if it is only a couple of incomplete entries it is not anything particular to worry about. If there were a bunch of incompletes it would look like the results of something sweeping your address range, which might be the result of malware (on the other hand at some customer sites I know of Security departments that routinely sweep their address space - not going to comment on whether that is something to worry about).
HTH
Rick
01-24-2007 11:19 AM
Rob,
Agree with Rick that if it's just a couple of incomplete entries it's probably not something you need to worry about. However, if you see a long list of incomplete entries in the ARP cache and if you know those devices are online then a traffic related issues, like broadcast storms, STP loops, DOS attack may be preventing ARP request/response packets from getting through and this would warrant some action on your part to resolve.
HTH
Sundar
01-25-2007 12:28 AM
Many thanks for the prompt replies - they confirmed what I suspected. There are only a couple of incomplete addresses, so doesn't look like it's anything to worry about.
Thanks once again
Rob
Find answers to your questions by entering keywords or phrases in the Search bar above. New here? Use these resources to familiarize yourself with the community: