Address Resolution Protocol is a layer 2 networking protocol used for resolving layer 3 addresses (such as IP addresses) into layer 2 addresses (such as Ethernet MACs). It is used by network devices when communicating with devices on the same layer 2 network.

learn more… | top users | synonyms

3
votes
1answer
562 views

Fast ARP scan in address-less DAD (Duplicate Address Discovery) mode

I am developing system for detecting network actual state. One part is to get all IPs and their respective MAC addresses. Right now I am using arping in DAD (Duplicate Address Discovery) mode. I send ...
3
votes
1answer
106 views

When wouldn't an ARP reply be generated?

Summary of the problem: a ping from client does not go to rpi1, its ARP call is not answerd at srv. host0and tap0 are bridged by br0. vpninand lan0 are two independent interfaces. All traffic ...
0
votes
2answers
55 views

Finding ip address from mac addess

I have router in bridge mode which is installed Openwrt and I want to find IP address of devices which are connected to the router. Since router is in bridge mode, I can not find IP from DHCP leases, ...
0
votes
1answer
31 views

ARP spoofing on switch across subnets

Consider a switch without any VLAN's defined with 2 subnets configured. Is it possible to ARP spoof from one subnet to another? According to Evans reply in What are the implications of having two ...
0
votes
0answers
7 views

libvirt bridge is not forwarding arp replys

I did set up an vm with libvirt but it gets only sometimes network connectivity. I could narrow the problem down to the bridge is not forwarding the arp replys from the vm. From within the VM I can ...
1
vote
1answer
26 views

FreeBSD bridge ARP replies not forwarded

I have a bridge between two networks using the same address space, and have very strange issues with ARP packets. Interface bridge0 has no IP address assigned, and has two members : em1 and em2. A ...
0
votes
0answers
12 views

Diagnosing the source of improper ARP requests on WAN side of Linux firewall/router

The kernel log on a Linux firewall/router I administer recently started filling with messages like these: net_ratelimit: 405 callbacks suppressed neighbour: arp_cache: neighbor table overflow! ...
-2
votes
3answers
59 views

Obtain MAC address of remote, unconfigured device?

I have a device that goes on the network. I need it's MAC address. There is no label on it. How do I do that? I have no access to the device itself. I can power it on and plug it in to a switch ...
0
votes
0answers
29 views

initial connections refused - connection warm up?

I've got two firewalled VMs connected to the same vLAN but I see RST/ACK responses on initial connection attempts in a while only to succeed on immediate following attempts, like some sort of cache ...
0
votes
1answer
45 views

iptable and ARP setup of linux router under a wifi network

My problem is the computer under the WiFi network cannot connect to the computer under a Linux hotspot which is connecting to the same WiFi. I am setting up a Linux hotspot under a WiFi network, ...
4
votes
2answers
127 views

When do STALE arp entries become FAILED when never used?

root@openwrt:~# ip -s -s -4 neigh show dev lan 10.64.42.121 lladdr b8:20:00:00:00:00 used 6387/6341/6313 probes 1 STALE 10.64.42.157 lladdr b8:20:00:00:00:00 used 24/813/19 probes 1 STALE 10.64.42.12 ...
0
votes
2answers
39 views

esxi arp cache not showing VLAN neighbours

On my ESXi 5.5 host I have 3 VLAN's plus one management (non-VLAN) LAN. When I print the arp cache (as show below) I notice that only the management LAN addresses are show (192.168.1.x). How do I ...
2
votes
1answer
2k views

Why is my Nexus 5548UP not adding ARP entries for the trunk to a 2960S?

I have a Nexus 5548UP trunked to a Catalyst 2960S. I have verified that spanning tree is working. I explicitly made the 2960S the root bridge for all VLANs as a temporary measure since it is trunked ...
0
votes
0answers
57 views

“No route to host” when i do a telnet in azure

I have two VM's in azure with different public IP's and whose private IP's are : 10.10.1.9 10.10.1.6 When i do a telnet with following command from the server 10.10.1.6, i get the a error: telnet ...
0
votes
1answer
47 views

Xen Server interference on ARP requests

I have a strange behaviour on my network as my unix-like hosts seem to have problems to reach the gateway. Digging into the network traffic via tcpdump, I've seen that two different hosts answer to ...
0
votes
1answer
63 views

TCP connection RST after FIN, ACK

I have a situation that would like to clarify with the experts here. I am no network expert so maybe it's normal, but i rather ask. We are trying to diagnose a problem between two servers, both are ...
8
votes
1answer
1k views

Dynamic ARP Entries turning into Static ARP entries

I recently acquired a client that has a strange ARP caching issue on one of thier servers. I have a server that will eventually start turning it's dynamic ARP entries into static ARP entries. This ...
0
votes
0answers
14 views

Firewall thinks ARP is being spoofed

My firewall log is filling with messages about a possible ARP spoofing attempt on my own LAN: 192.168.111.60 is a Synology RS815RP+ NAS on my LAN. 192.168.111.7 is a Lenovo EMC px4-300r NAS. Both ...
0
votes
1answer
108 views

Cisco WAP321 dropping ARP packets

At my office we have 4 WAP321 connected directly to a Cisco 891f router. Randomly throughout the day, computers will lose access to the network. They will remain connected to the Wifi SSID, but can't ...
1
vote
0answers
49 views

Understanding arp request tcpdump

I noticed the below tcp dump when pinging a docker container B on bridge B from a docker container A on bridge A. Container A: 10.0.0.3 / 02:42:0a:00:00:03 Container B: 10.0.0.4 / 02:42:0a:...
0
votes
0answers
12 views

Frequent unicast ARP requests

Wireshark screen I would like to ask if it's considered to be a normal behavior of a router to issue this many (as shown in the screenshot) "refreshing" arp request? As I do not see, for instance, my ...
2
votes
1answer
72 views

Juniper EX3200 connected to Cisco 2900 series router - incomplete ARP entry

I'm tying to connect a Call Manager Express running on a Cisco 2900 series router to a Juniper EX3200 switch. I have both configured on VLAN 4, with both ports in access mode but when I connect the ...
0
votes
0answers
43 views

What is the difference between arp_ignore and arp_filter?

What is the exact difference between the arp_ignore flag and the arp_filter flag defined in syctl.conf in Linux? Both seems to serve the same purpose.
2
votes
4answers
4k views

Strange linux neighbor cache entries (whole-world-is-link-local syndrome) (linux 3.0.0-16)

On absolutely standard ubuntu-server linux distro running only BIND cache, sometimes i see non-link-local ip addresses in the arp/nei table and there is no way to communicate with those entries After ...
0
votes
1answer
34 views

Make Linux reply to certain ARP requsts

I’m trying to pull a certain routing stunt where I want my Linux server to respond to arp requests for 10.0.0.1 on eth0, although 10.0.0.1 is not the configured IP for eth0 (in which case the ...
18
votes
11answers
88k views

Is there any way to ARP ping on Windows?

On Linux and other systems, there is an utility called arping which can be used to send ARP requests ("pings") and show the answers, much like the "ping" utility but using ARP instead of ICMP. Is ...
1
vote
1answer
3k views

How to reverse arp using nping for Windows

I would like to send a reverse ARP to resolve an IP address given a MAC address using nping for Windows. The documentation is not clear on how this should work and I'm unable to find any examples ...
2
votes
2answers
2k views

Linux is sending ARP requests to hosts in other subnets?

Setup Host B <--> Router <--> Host A Host A: IP = 192.168.1.10, Net = 192.168.1.0/24, VLAN = 1, Default GW = 192.168.1.1 (Router) Host B: IP = 192.168.2.10, Net = 192.168.2.0/24, VLAN =...
2
votes
0answers
56 views

Ping problems with two interfaces, same subnet, direct connections to two separate hosts

I have a configuration of a client machine (Ubuntu 14.04.2 LTS) that directly connects to two server machines. The server machines--while on the same subnet--cannot route to each other. Packets must ...
0
votes
1answer
70 views

iwconfig and arp commands report slightly different MAC addresses

I'm at a wifi hotspot where, when I look up the router's MAC address by two different methods, I get slightly different results: $ arp -a ? (10.128.128.128) at 00:18:0a:58:WX:YZ [ether] on wlan0 ? (...
0
votes
0answers
49 views

arpwatch to listen only to particular network

I deploy arpwatch is our network and it is working fine. But it is not doing exactly what i need. Here is what i need ... i want it to listen to one particular network ... for example on ethernet 0 it ...
0
votes
1answer
31 views

sudden increase in arp entries when i rlogin from one node to another node

when I r-login from my one host to another, I am observing sudden increase in arp entries from 80 to 900. and this is causing neighbour table overflow. can anyone suggest why this is happening?? ...
-1
votes
1answer
135 views

Default gateway and ARP confusion

I have the following configuration (I'd post a pic but not enough rep for more than 2): PC1 (10.0.2.10/24) and PC2 (10.0.2.137/29) are connected to a hub, which is connected to a router on interface ...
6
votes
3answers
8k views

arp --delete is not deleting an entry; merely marks entry as “incomplete”

$ sudo arp -avn ? (10.10.7.30) at 00:cc:cc:bb:dd:86 [ether] on eth0 Entries: 1 Skipped: 0 Found: 9 $ sudo arp -d 10.10.7.30 $ sudo arp -avn ? (10.10.7.30) at <incomplete> [ether] on eth0 I ...
3
votes
1answer
1k views

nmap and arp-scan inconsistent IP-MAC results

I seem to get variable and inconsistent results for the IP/MAC addresses from a particular machine, using nmap or arp-scan. The machine has 3 interfaces, and this is what it shows: $ uname -a Linux ...
0
votes
0answers
55 views

ARP cache getting null mac over a bridge

I have an interface eno1 and a bridge br0 $ ifconfig br0: flags=4163<UP,BROADCAST,RUNNING,MULTICAST> mtu 1500 inet 192.168.250.53 netmask 255.255.255.0 broadcast 192.168.250.255 ...
0
votes
1answer
121 views

First ping (to any destination) fails from switch but not from router

I've got a basic network setup, just doing NAT to a single public address to an internal /24 without any VLAN's or fancy routing. Both my router and switch are running Cisco IOS 12.x. My ...
1
vote
3answers
484 views

Scanning network devices by mac address

I work in the security devices industry and most of my work relates to IP cameras. Each camera manufacturer has their own software that scans the network for their cameras and gives details about ...
1
vote
0answers
29 views

ESX 6 arp fails in back 2 back link

we are having a strange problem with back 2 back connection between an ESX 6 and CentOS 7 machine. Hoping to find a solution on stackoverflow The story is below: - we are using a CentOS 7 directly ...
0
votes
4answers
21k views

What happens when ARP Request comes from a different subnet?

What will happen when an ARP Request packet is sent from router1 to router2 in the following two cases? Will an ARP Reply be generated or the ARP Request packet be dropped? [router1]Intf1(20.0.0.1/...
18
votes
5answers
42k views

ARP broadcast flooding network and high cpu usage

Hoping someone here might have some insight to the issue we are facing. Currently we have Cisco TAC looking at the case but they are struggling to find the root cause. Although the title mentions ARP ...
3
votes
0answers
67 views

ARP behavior in Linux

I have a L3 switch. Port 1 and port 2 of the switch are added to VLAN 30 and an IP address (30.0.0.1) is assigned to it. Port1 and port2 are connected to Host1 and Host2 respectively. Host 1 and ...
0
votes
2answers
1k views

Cannot ping gateway

I replaced my aging fileserver with a new server running ESXi 5.1 and migrated my fileserver in a virtual machine running on it. Now I have the following problem with this VM: I'm getting the ...
3
votes
0answers
95 views

Xen networking - dom0 receives ARP requests but no reachability

Both dom0 and domU are Debian 8. Dom0 network configuration is: auto xenbr0 iface xenbr0 inet manual bridge_ports eth1 bridge_stp off bridge_waitport 0 bridge_fd 0 auto xenbr0.4 ...
0
votes
1answer
92 views

Cisco IPv6 Proxy-arp like IPv4

Can I disable the proxy-arp in IPv6 in Cisco? I cannot find the "no ipv6 proxy-arp" command in my Cisco router. Please teach me how to do it. Thanks.
3
votes
0answers
227 views

Windows 10 arp cache getting stuck after failed attempts when target machines are offline

After upgrading our development team to Windows 10 from 7, we are experiencing an issue with the ARP cache where a machine has the correct IP-MAC mapping cached, but the type is invalid due to failed ...
0
votes
0answers
65 views

Cisco 2960X & IPDT

I am interested in finding the IP addresses assigned to devices attached to each interface on a Cisco 2960X switch. It seems like IPDT is exactly what I'm looking for. However it seems like the ...
1
vote
1answer
134 views

ARP Request Being Sent To Different Subnet From Ubuntu Linux

This question is very similar to this one: Linux is sending ARP requests to hosts in other subnets? Main problem - Ubuntu Linux server is sending ARP requests asking for a MAC address of a host on a ...
0
votes
0answers
47 views

Ubuntu - Destination Host Unreachable Through Router / ARP Requests

Very strange issues on an Ubuntu server running DNS. Here is the network setup. There are two class C network ranges. Let's say they are: 216.107.249.0/24 216.107.250.0/24 Server is assigned an ...
1
vote
0answers
71 views

ARP issuse in SUSE Linux

I am dealing with a very strange problem. I have a VM running SLES 11 SP4 in VMware Environment. The machine has two NIC. All of a sudden the second NIC stopped working. It's not even pinging the ...