cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
894
Views
0
Helpful
3
Replies

Incomplete MAC addresses

rob.nicholson
Level 1
Level 1

Hi,

Just a quick one - what could cause incomplete MAC addresses in the ARP? I know that they can be caused if you try to reach an IP address which is currently not available because it is wrong, or the device with the assigned IP address is currently down or not connected. There are only a couple of incomplete MAC addresses - is this anything out of the ordinary?

Thanks in advance

Rob

3 Replies 3

Richard Burts
Hall of Fame
Hall of Fame

Rob

My opinion is that if it is only a couple of incomplete entries it is not anything particular to worry about. If there were a bunch of incompletes it would look like the results of something sweeping your address range, which might be the result of malware (on the other hand at some customer sites I know of Security departments that routinely sweep their address space - not going to comment on whether that is something to worry about).

HTH

Rick

HTH

Rick

Rob,

Agree with Rick that if it's just a couple of incomplete entries it's probably not something you need to worry about. However, if you see a long list of incomplete entries in the ARP cache and if you know those devices are online then a traffic related issues, like broadcast storms, STP loops, DOS attack may be preventing ARP request/response packets from getting through and this would warrant some action on your part to resolve.

HTH

Sundar

Many thanks for the prompt replies - they confirmed what I suspected. There are only a couple of incomplete addresses, so doesn't look like it's anything to worry about.

Thanks once again

Rob

Getting Started

Find answers to your questions by entering keywords or phrases in the Search bar above. New here? Use these resources to familiarize yourself with the community: