Address Resolution Protocol is a layer 2 networking protocol used for resolving layer 3 addresses (such as IP addresses) into layer 2 addresses (such as Ethernet MACs). It is used by network devices when communicating with devices on the same layer 2 network.

learn more… | top users | synonyms

36
votes
6answers
6k views

Windows 2008 ignores Gratuitous ARP requests

We recently saw an issue after a fail over of our router where our Windows 2008 Boxes didn't start talking to the primary router after fail-back. When we did some digging they still had the ARP ...
22
votes
13answers
183k views

How to get a list of all IP addresses (and ideally device names) on a LAN?

Our network gave an error that there was an IP address conflict and I'd like to find what all the device IP addresses are. (I've also had need of that before). (update/clarification:I'm looking for a ...
14
votes
5answers
12k views

ARP broadcast flooding network and high cpu usage

Hoping someone here might have some insight to the issue we are facing. Currently we have Cisco TAC looking at the case but they are struggling to find the root cause. Although the title mentions ARP ...
13
votes
8answers
57k views

Is there any way to ARP ping on Windows?

On Linux and other systems, there is an utility called arping which can be used to send ARP requests ("pings") and show the answers, much like the "ping" utility but using ARP instead of ICMP. Is ...
13
votes
5answers
26k views

Ubuntu Linux - multiple NICs, same LAN… ARP responses always go out a single NIC

We've got AT&T U-Verse internet service, which has an extremely boneheaded DSL gateway. We have 5 IPs (netmask 248), but the gateway is incapable of doing anything other than a single IP -> ...
12
votes
2answers
2k views

Machine always responds to 192.168.1.2 IP address, which is not set on the machine

UPDATE BELOW: UPDATE 2 BELOW: FINAL Solution I have a brand new HP EliteBook notebook 8560p running Windows 7 64bit. I plug it into a small Dlink di-604 router, it is currently configured with DHCP ...
12
votes
2answers
4k views

Strange: why does linux respond to ping with ARP request after last ping reply?

I (and a colleague) have just noticed, and tested, that when a Linux machine is pinged, after the last ping it initiates a unicast ARP request to the machine that initiated the ICMP ping. When pinging ...
12
votes
2answers
2k views

arp-requests cannot be seen by specific nodes

I create an open ad-hoc wlan by using iwconfig (I have the same issue with wpa_supplicant as well). there are 4 nodes on the network as seen on the figure below. The nodes run ubuntu 12.04 and debian ...
11
votes
3answers
19k views

How to broadcast ARP update to all neighbors in Linux?

Some clients in the subnet has cached the IP with old MAC address, I want them to update the new value by doing a ARP broadcast, is it possible in Linux?
9
votes
5answers
8k views

ARP replies contain wrong MAC address

I've got a robot running linux with wired and wireless adapters. When I boot up, it connects to the wireless fine. When I assign an IP to the wired (either statically or with DHCP), it looks like it ...
9
votes
4answers
1k views

Network throughput issue (ARP-related)

The small college where I work is having some very strange network issues. I'm looking for any advice or ideas here. We were fine over the summer, but the trouble began few days after students ...
7
votes
7answers
16k views

Is it possible to match an internal IP address to a switch port?

I'm trying to find a computer that has a certain IP address on our internal network. I have identified the computer name from DNS, but in this case it does not help me. Just wondering if I can ...
7
votes
1answer
4k views

How do I poll the ARP table with an SNMP OID?

When you need to poll the ARP table of a device, conventional wisdom is to use ipNetToMediaPhysAddress or atPhysAddress; however, both of these OIDs are deprecated according to Cisco's documentation. ...
7
votes
2answers
4k views

NIC Teaming with Broadcom on HyperV 2008 R2

I have a HyperV cluster made up of 3 hosts. Each host is connected to both of my Nexus 5548 switches running in an etherchannel. LACP on the switch and NIC teaming using Broadcom 802.3ad on the server ...
7
votes
2answers
1k views

linux routing bug?

I have been struggling with this not easily reproducible issue since a while. I am using linux kernel v3.1.0, and sometimes routing to a few IP addresses does not work. What seems to happen is that ...
6
votes
4answers
7k views

How to find the process which causes the arp request?

When i run tcpdump in the gateway, i get a lot of arp requests originating from the gateway itself. I wonder know why this happens. How can i find the process that causes these arp requests? $ ...
6
votes
6answers
6k views

Cluster failover and strange gratuitous arp behavior

I am experiencing a strange Windows 2008R2 cluster related issue that is bothering me. I feel that I have come close as to what the issue is, but still don't fully understand what is happening. I ...
6
votes
1answer
1k views

Linux arp cache timeout values

I'm trying to configure sane values for the Linux kernel arp cache timeout, but I can't find a detailed explanation as to how they work anywhere. Even the kernel.org documentation doesn't give a good ...
6
votes
1answer
779 views

Random and Selective ARP blindness in VMWare ESXi 4.1

We have multiple VMWare ESX servers spread out amongst our company, doing various tasks. One particular ESXi host is exhibiting very peculiar behavior. We detect it when our monitoring system ...
5
votes
1answer
276 views

Which NIC have the IP address?

If I have two NICs where I know the MAC addresses. Without logging into the server, how do I figure out which have the IP address 10.10.10.10? Can arp somehow be used for this?
5
votes
2answers
4k views

Why my laptop sends ARP request to itself?

I have just started to learn about protocols. While studying the packets in wireshark, I came across a ARP request sent by my machine to my own IP. Here is the details of the packet : No. Time ...
5
votes
3answers
3k views

Windows 2008 R2 Servers Sending Arp Requests for IPs outside Subnet

By running a packet capture on my my routers I see some of my servers sending ARP requests for IPs that exist outside of its network. For example if my network is: Network: 8.8.8.0/24 Gateway: ...
5
votes
1answer
136 views

Sender Information Not Cached on the Receiver During an ARP Request

I'm currently trying to get my head around more advanced networking concepts. The way I am doing this is by going on one of the servers I look after as a sysadmin and running network captures to see ...
5
votes
2answers
337 views

Ubuntu 12 crashed and took down network

We recently set up a new Ubuntu 12.04LTS server on our network. It's not fully configured so it's not doing much beyond sshd and a default apache2 install. But this evening it appears to have ...
4
votes
3answers
3k views

Wireshark running on a server seeing lots of `ARP who has` with different tells

We're seeing some suspicious network activity, and when I was trying to see if it was one particular server of ours I ran a Wireshark trace. I noted a lot of ARP packets asking who has x.x.x.x, but ...
4
votes
1answer
345 views

tcpdump on interface when pinging nonexistent hosts on local network

I've statically configured the IP address of an interface on a server: ip addr add 10.40.0.6/16 broadcast 10.40.255.255 dev eth1 If I try to ping a machine on the network (e.g., 10.40.0.1), it ...
4
votes
1answer
375 views

Cannot ping B from A until B pings A

I have a server cluster all connected on a local network(all physical machines, not virtual). When trying to ping from Server A to B, I get a Desitination Host Unreachable. I can ping from B to A no ...
4
votes
1answer
3k views

Why ARP request is unicast?

I have a wireshark capture that indicating a unicast ARP request from source to destination. As per my understanding ARP requests (including gratutious ARP) use broadcast. In what case the ...
4
votes
4answers
10k views

Clearing ARP cache on ESXi 4.1

We recently migrated our entire VMware cluster from ESX over to ESXi. For the most part, the transition was seamless, and I haven't missed having access to the SC. Until now. We're trying to diagnose ...
4
votes
2answers
6k views

Clear arp cache

How to clear arp cache ? How to refresh arp table ?
4
votes
2answers
3k views

Is it possible to use proxy-arp back to the same interface?

I have a WiFi Access Point connected to a Linux Router. The Router is itself connected to the Internet. For multiple reasons (mostly to control security and quality of service), I want to force all ...
4
votes
2answers
5k views

Neighbour table overflow on Linux hosts related to bridging and ipv6

Note: I already have a workaround for this problem (as described below) so this is only a "want-to-know" question. I have a productive setup with around 50 hosts including blades running xen 4 and ...
4
votes
3answers
5k views

How to configure remote access to multiple subnets behind a SonicWALL NSA 2400

I have a client that uses a SonicWALL NSA 2400 as their firewall. I need to setup a second LAN subnet for a handful of PC. Management has decided that there should be a second subnet even though ...
4
votes
1answer
735 views

Arp requests with odd source IP go unanswered

I'm having a server with network connectivity issues that I presume come from issues with arp protocol handling. Let's say the network topology is as follows: network 192.168.106.0, netmask ...
4
votes
1answer
1k views

ARP reply vanishes from br0 to tap0 using OpenVPN in bridging mode

i have setup a linux box (on an esxi5) which acts as an openvpn server. the server is configured to use bridging for the clients, which essentially works, with one exception. if the client pings some ...
3
votes
4answers
754 views

What happens if I ask 127.0.0.1 via arp broadcasting?

Will all the computers on the network will answer me?
3
votes
2answers
4k views

how can I stop my sonicwall TZ-210 (SonicOS Enhanced 5.5.1.0-5o) from responding to arp queries on the wan subnet?

My sonicwall TZ-210 is answering arp queries on the wan subnet (which my isp doesn't like), basically mapping all the wan ips to its own mac address, causing network havoc since it is not set to route ...
3
votes
2answers
467 views

Windows 7 Requires ARP for UDP?

Seems like my Windows 7 box (with 2 NICs if that's relevant) requires an ARP response before it sends packets to a certain IP address. The specific context I'm in is running a TFTP server (TFTPD32). ...
3
votes
1answer
2k views

Wireshark arp packets

In wireshark, after capturing some arp packets, what is the significance of all 1's in the destination field. of an Ethernet II frame?
3
votes
3answers
15k views

How can I fix a bad arp entry?

I'm just guessing that arp is my problem... I have a linux drbd server cluster set up, and due to some power issues had to unplug the switch that connects the two servers. As a result, both servers ...
3
votes
1answer
1k views

pfsense single MAC is listed with several IP's in ARP table

I have this problem: arp table filling up But I am quite sure that I cannot blame Kaspersky. Scenarie: a user plugs his computer in. He waits and waits but are getting no IP by DHCP. Then he is ...
3
votes
2answers
11k views

How to prevent / detect ARP poison rooting attacks?

Although we have not had any first-hand experience with these kind of attacks (as far as we know of) I would like to know how to prevent them from happening as much as possible. I mostly use my ...
3
votes
1answer
3k views

Ubuntu Linux - two interfaces, same subnet, different vlan - MAC/ARP issues

I'm attempting to setup a server that needs to have interfaces on the same IP subnet, but different VLANs: eth1.102 Link encap:Ethernet HWaddr 00:50:56:b1:00:0f inet addr:10.1.1.6 ...
3
votes
1answer
214 views

Same network on different interface

We work with devices that are flashed (factory) using TFTP on a usb network connection. The server has a fixed 192.168.2.100 address and the device a fixed 192.168.2.101 address. When it starts, it ...
3
votes
1answer
2k views

How to test 10 gigabit Intel X520 on Ubuntu

I got Intel X520 and connected it to PCI-E x16. The card is recognized as 10 Gbit by ethtool: # ethtool eth5 Settings for eth5: Supported ports: [ FIBRE ] Supported link modes: ...
3
votes
0answers
114 views

VMXNET3 nic loses the ability to update ARP table after N hours

I have a fedora 18 VM that stops updating the arp table on eth1 after running for a number of hours to days. There are other VMs on the same hypervisor that can access all of the same networks without ...
3
votes
1answer
448 views

nmap and arp-scan inconsistent IP-MAC results

I seem to get variable and inconsistent results for the IP/MAC addresses from a particular machine, using nmap or arp-scan. The machine has 3 interfaces, and this is what it shows: $ uname -a Linux ...
3
votes
1answer
404 views

Windows Server 2008 ARP Cache Poisioning

Recently ran into a very strange problem. Several applications were having issues communication through our F5 Load-Balancer. When we looked into it we found that the router had an incorrect ARP and ...
3
votes
0answers
519 views

Dynamic ARP Entries turning into Static ARP entries

I recently acquired a client that has a strange ARP caching issue on one of thier servers. I have a server that will eventually start turning it's dynamic ARP entries into static ARP entries. This ...
2
votes
3answers
2k views

Should a Dell 5424 switch have an arp entry for every machine connected to it?

I've got a Dell 5424 with about 20 machines directly attached to it. I did a ping sweep of my network (and got answers from all 20), then went to the CLI of the switch and did show arp. To my ...