One of our windows servers was compromised, causing us to start having ARP cache issues. The switch port that that machine was on is now off. We are still (slowly) getting this error:
Jun 4 18:17:54 CDT: %IP-4-ZERO_ADDR: Zero MAC address for 10.1.0.1 in ARP cache
But the interfaces to which they show up are only interfaces on the router itself. We have configured Snort to try to resolve some of these issues, but do not know where to look when the interfaces that are listed are only the ones on the router itself.
An update. I've discovered that the MAC address on the port channel on this router truly IS coming up all zeros. And the ARP cache on the switch it is connected to says the same thing. in the show interface on that port channel on the router- it shows:
Port-channel1 is up, line protocol is up
Hardware is FEChannel, address is 0000.0000.0000 (bia 0050.739f.6500)
What can cause the port channel's mac address to basically disappear?
We are pleased to announce availability of Beta software for 16.6.3. 16.6.3 will be the second rebuild on the 16.6 release train targeted towards Catalyst 9500/9400/9300/3850/3650 switching platforms. We are looking for early feedback from custome...