Address Resolution Protocol is a layer 2 networking protocol used for resolving layer 3 addresses (such as IP addresses) into layer 2 addresses (such as Ethernet MACs). It is used by network devices when communicating with devices on the same layer 2 network.

learn more… | top users | synonyms

35
votes
6answers
5k views

Windows 2008 ignores Gratuitous ARP requests

We recently saw an issue after a fail over of our router where our Windows 2008 Boxes didn't start talking to the primary router after fail-back. When we did some digging they still had the ARP ...
21
votes
13answers
159k views

How to get a list of all IP addresses (and ideally device names) on a LAN?

Our network gave an error that there was an IP address conflict and I'd like to find what all the device IP addresses are. (I've also had need of that before). (update/clarification:I'm looking for a ...
14
votes
5answers
2k views

ARP broadcast flooding network and high cpu usage

Hoping someone here might have some insight to the issue we are facing. Currently we have Cisco TAC looking at the case but they are struggling to find the root cause. Although the title mentions ARP ...
12
votes
8answers
47k views

Is there any way to ARP ping on Windows?

On Linux and other systems, there is an utility called arping which can be used to send ARP requests ("pings") and show the answers, much like the "ping" utility but using ARP instead of ICMP. Is ...
12
votes
5answers
24k views

Ubuntu Linux - multiple NICs, same LAN… ARP responses always go out a single NIC

We've got AT&T U-Verse internet service, which has an extremely boneheaded DSL gateway. We have 5 IPs (netmask 248), but the gateway is incapable of doing anything other than a single IP -> ...
12
votes
2answers
2k views

Machine always responds to 192.168.1.2 IP address, which is not set on the machine

UPDATE BELOW: UPDATE 2 BELOW: FINAL Solution I have a brand new HP EliteBook notebook 8560p running Windows 7 64bit. I plug it into a small Dlink di-604 router, it is currently configured with DHCP ...
12
votes
2answers
3k views

Strange: why does linux respond to ping with ARP request after last ping reply?

I (and a colleague) have just noticed, and tested, that when a Linux machine is pinged, after the last ping it initiates a unicast ARP request to the machine that initiated the ICMP ping. When pinging ...
12
votes
2answers
928 views

arp-requests cannot be seen by specific nodes

I create an open ad-hoc wlan by using iwconfig (I have the same issue with wpa_supplicant as well). there are 4 nodes on the network as seen on the figure below. The nodes run ubuntu 12.04 and debian ...
10
votes
3answers
12k views

How to broadcast ARP update to all neighbors in Linux?

Some clients in the subnet has cached the IP with old MAC address, I want them to update the new value by doing a ARP broadcast, is it possible in Linux?
9
votes
5answers
7k views

ARP replies contain wrong MAC address

I've got a robot running linux with wired and wireless adapters. When I boot up, it connects to the wireless fine. When I assign an IP to the wired (either statically or with DHCP), it looks like it ...
8
votes
4answers
790 views

Network throughput issue (ARP-related)

The small college where I work is having some very strange network issues. I'm looking for any advice or ideas here. We were fine over the summer, but the trouble began few days after students ...
7
votes
7answers
14k views

Is it possible to match an internal IP address to a switch port?

I'm trying to find a computer that has a certain IP address on our internal network. I have identified the computer name from DNS, but in this case it does not help me. Just wondering if I can ...
7
votes
2answers
3k views

NIC Teaming with Broadcom on HyperV 2008 R2

I have a HyperV cluster made up of 3 hosts. Each host is connected to both of my Nexus 5548 switches running in an etherchannel. LACP on the switch and NIC teaming using Broadcom 802.3ad on the server ...
6
votes
6answers
4k views

Cluster failover and strange gratuitous arp behavior

I am experiencing a strange Windows 2008R2 cluster related issue that is bothering me. I feel that I have come close as to what the issue is, but still don't fully understand what is happening. I ...
6
votes
2answers
1k views

linux routing bug?

I have been struggling with this not easily reproducible issue since a while. I am using linux kernel v3.1.0, and sometimes routing to a few IP addresses does not work. What seems to happen is that ...
6
votes
1answer
2k views

How do I poll the ARP table with an SNMP OID?

When you need to poll the ARP table of a device, conventional wisdom is to use ipNetToMediaPhysAddress or atPhysAddress; however, both of these OIDs are deprecated according to Cisco's documentation. ...
6
votes
1answer
609 views

Random and Selective ARP blindness in VMWare ESXi 4.1

We have multiple VMWare ESX servers spread out amongst our company, doing various tasks. One particular ESXi host is exhibiting very peculiar behavior. We detect it when our monitoring system ...
5
votes
1answer
272 views

Which NIC have the IP address?

If I have two NICs where I know the MAC addresses. Without logging into the server, how do I figure out which have the IP address 10.10.10.10? Can arp somehow be used for this?
5
votes
2answers
3k views

Why my laptop sends ARP request to itself?

I have just started to learn about protocols. While studying the packets in wireshark, I came across a ARP request sent by my machine to my own IP. Here is the details of the packet : No. Time ...
5
votes
4answers
6k views

How to find the process which causes the arp request?

When i run tcpdump in the gateway, i get a lot of arp requests originating from the gateway itself. I wonder know why this happens. How can i find the process that causes these arp requests? $ ...
5
votes
3answers
3k views

Windows 2008 R2 Servers Sending Arp Requests for IPs outside Subnet

By running a packet capture on my my routers I see some of my servers sending ARP requests for IPs that exist outside of its network. For example if my network is: Network: 8.8.8.0/24 Gateway: ...
5
votes
1answer
125 views

Sender Information Not Cached on the Receiver During an ARP Request

I'm currently trying to get my head around more advanced networking concepts. The way I am doing this is by going on one of the servers I look after as a sysadmin and running network captures to see ...
5
votes
1answer
359 views

Linux arp cache timeout values

I'm trying to configure sane values for the Linux kernel arp cache timeout, but I can't find a detailed explanation as to how they work anywhere. Even the kernel.org documentation doesn't give a good ...
5
votes
2answers
296 views

Ubuntu 12 crashed and took down network

We recently set up a new Ubuntu 12.04LTS server on our network. It's not fully configured so it's not doing much beyond sshd and a default apache2 install. But this evening it appears to have ...
4
votes
3answers
473 views

Wireshark running on a server seeing lots of `ARP who has` with different tells

We're seeing some suspicious network activity, and when I was trying to see if it was one particular server of ours I ran a Wireshark trace. I noted a lot of ARP packets asking who has x.x.x.x, but ...
4
votes
1answer
172 views

tcpdump on interface when pinging nonexistent hosts on local network

I've statically configured the IP address of an interface on a server: ip addr add 10.40.0.6/16 broadcast 10.40.255.255 dev eth1 If I try to ping a machine on the network (e.g., 10.40.0.1), it ...
4
votes
1answer
151 views

Cannot ping B from A until B pings A

I have a server cluster all connected on a local network(all physical machines, not virtual). When trying to ping from Server A to B, I get a Desitination Host Unreachable. I can ping from B to A no ...
4
votes
4answers
9k views

Clearing ARP cache on ESXi 4.1

We recently migrated our entire VMware cluster from ESX over to ESXi. For the most part, the transition was seamless, and I haven't missed having access to the SC. Until now. We're trying to diagnose ...
4
votes
3answers
4k views

How to configure remote access to multiple subnets behind a SonicWALL NSA 2400

I have a client that uses a SonicWALL NSA 2400 as their firewall. I need to setup a second LAN subnet for a handful of PC. Management has decided that there should be a second subnet even though ...
4
votes
1answer
583 views

Arp requests with odd source IP go unanswered

I'm having a server with network connectivity issues that I presume come from issues with arp protocol handling. Let's say the network topology is as follows: network 192.168.106.0, netmask ...
3
votes
4answers
687 views

What happens if I ask 127.0.0.1 via arp broadcasting?

Will all the computers on the network will answer me?
3
votes
2answers
3k views

how can I stop my sonicwall TZ-210 (SonicOS Enhanced 5.5.1.0-5o) from responding to arp queries on the wan subnet?

My sonicwall TZ-210 is answering arp queries on the wan subnet (which my isp doesn't like), basically mapping all the wan ips to its own mac address, causing network havoc since it is not set to route ...
3
votes
2answers
325 views

Windows 7 Requires ARP for UDP?

Seems like my Windows 7 box (with 2 NICs if that's relevant) requires an ARP response before it sends packets to a certain IP address. The specific context I'm in is running a TFTP server (TFTPD32). ...
3
votes
1answer
1k views

Wireshark arp packets

In wireshark, after capturing some arp packets, what is the significance of all 1's in the destination field. of an Ethernet II frame?
3
votes
3answers
14k views

How can I fix a bad arp entry?

I'm just guessing that arp is my problem... I have a linux drbd server cluster set up, and due to some power issues had to unplug the switch that connects the two servers. As a result, both servers ...
3
votes
2answers
4k views

Clear arp cache

How to clear arp cache ? How to refresh arp table ?
3
votes
1answer
768 views

pfsense single MAC is listed with several IP's in ARP table

I have this problem: arp table filling up But I am quite sure that I cannot blame Kaspersky. Scenarie: a user plugs his computer in. He waits and waits but are getting no IP by DHCP. Then he is ...
3
votes
2answers
11k views

How to prevent / detect ARP poison rooting attacks?

Although we have not had any first-hand experience with these kind of attacks (as far as we know of) I would like to know how to prevent them from happening as much as possible. I mostly use my ...
3
votes
2answers
3k views

Neighbour table overflow on Linux hosts related to bridging and ipv6

Note: I already have a workaround for this problem (as described below) so this is only a "want-to-know" question. I have a productive setup with around 50 hosts including blades running xen 4 and ...
3
votes
1answer
2k views

Ubuntu Linux - two interfaces, same subnet, different vlan - MAC/ARP issues

I'm attempting to setup a server that needs to have interfaces on the same IP subnet, but different VLANs: eth1.102 Link encap:Ethernet HWaddr 00:50:56:b1:00:0f inet addr:10.1.1.6 ...
3
votes
1answer
141 views

Same network on different interface

We work with devices that are flashed (factory) using TFTP on a usb network connection. The server has a fixed 192.168.2.100 address and the device a fixed 192.168.2.101 address. When it starts, it ...
3
votes
1answer
2k views

How to test 10 gigabit Intel X520 on Ubuntu

I got Intel X520 and connected it to PCI-E x16. The card is recognized as 10 Gbit by ethtool: # ethtool eth5 Settings for eth5: Supported ports: [ FIBRE ] Supported link modes: ...
3
votes
0answers
23 views

VMXNET3 nic loses the ability to update ARP table after N hours

I have a fedora 18 VM that stops updating the arp table on eth1 after running for a number of hours to days. There are other VMs on the same hypervisor that can access all of the same networks without ...
3
votes
1answer
230 views

Windows Server 2008 ARP Cache Poisioning

Recently ran into a very strange problem. Several applications were having issues communication through our F5 Load-Balancer. When we looked into it we found that the router had an incorrect ARP and ...
3
votes
0answers
333 views

Dynamic ARP Entries turning into Static ARP entries

I recently acquired a client that has a strange ARP caching issue on one of thier servers. I have a server that will eventually start turning it's dynamic ARP entries into static ARP entries. This ...
3
votes
1answer
765 views

ARP reply vanishes from br0 to tap0 using OpenVPN in bridging mode

i have setup a linux box (on an esxi5) which acts as an openvpn server. the server is configured to use bridging for the clients, which essentially works, with one exception. if the client pings some ...
2
votes
3answers
2k views

Should a Dell 5424 switch have an arp entry for every machine connected to it?

I've got a Dell 5424 with about 20 machines directly attached to it. I did a ping sweep of my network (and got answers from all 20), then went to the CLI of the switch and did show arp. To my ...
2
votes
4answers
332 views

ARP packets never routed?

is it true ARP only works in single broadcast domain and arp packets are not routed frm 1 network to another ? can any one give me any example or any source of info for this hoping for positive ...
2
votes
2answers
237 views

Why computer scanning network?

I have found out through Wireshark that a computer in my subnet scanning network ( sending ARPs for every IP-address in my subnet. Even if there no computers with such address). It repeats ...
2
votes
2answers
274 views

Why do all computers on my network have the same MAC address?

I'm on a LAN provided by an ISP. My computer has its IP address, Subnet Mask, Default Gateway, DNS Servers(using DHCP). I just wanted to see the MAC addresses of all the computers on my LAN. After ...