Address Resolution Protocol is a layer 2 networking protocol used for resolving layer 3 addresses (such as IP addresses) into layer 2 addresses (such as Ethernet MACs). It is used by network devices when communicating with devices on the same layer 2 network.

learn more… | top users | synonyms

2
votes
1answer
2k views

How to setup a static multicast ARP entry with Cisco SG300?

We're running a Microsoft NLB cluster in multicast mode as a loadbalancer. Using our old Cisco IOS switches we propagate access to the cluster to our branches using a static ARP entry in the core ...
2
votes
1answer
265 views

ARP discovery on multiple subnets

I have an unmanaged switch which serves traffic belonging to different subnets. Lets say these are the subnets: 192.168.0.0/24 192.168.1.0/24 192.168.2.0/24 And few more subnets which I am not aware ...
2
votes
1answer
586 views

Multi-NIC Linux machine's NICs are responding to each other's ARPs regardless of arp_filter setting

I have an old Linux machine running a 2.4.37 kernel. In the machine are two NIC cards both on the same network with different IPs. For some testing, we want each IP's traffic routed through that NIC, ...
2
votes
1answer
1k views

Solaris does not record MAC address in ARP table

I have noticed that a Solaris 9 server keeps sending ARP requests for an IP address that is owned by our DNS server. The DNS server answers with its MAC address but Solaris 9 does not record the ...
2
votes
1answer
711 views

Is there a config file for ubuntu server like /etc /ethers to config the mac-ip bind?

i can't find /etc/ethers in ubuntu server:< i want save something like "sudo arp -s someipaddress macaddress" so i don't need to set it again after reboot
2
votes
1answer
670 views

Effects of having a rapid ARP flush

So the scenario is we have a web server at our colocation. In front of that web server are two SonicWalls and two L2 non-stacking managed switches. We're trying to find an efficient way to set up ...
2
votes
2answers
5k views

No ARP reply on tap0 (KVM bridged networking)

I wanted to assign an external IP address to my KVM guest and went the bridged networking way. Unfortunately the guest has no network connectivity and I don't know why. After investigating it seems ...
2
votes
1answer
49 views

Juniper EX3200 connected to Cisco 2900 series router - incomplete ARP entry

I'm tying to connect a Call Manager Express running on a Cisco 2900 series router to a Juniper EX3200 switch. I have both configured on VLAN 4, with both ports in access mode but when I connect the ...
2
votes
0answers
47 views

Ping problems with two interfaces, same subnet, direct connections to two separate hosts

I have a configuration of a client machine (Ubuntu 14.04.2 LTS) that directly connects to two server machines. The server machines--while on the same subnet--cannot route to each other. Packets must ...
2
votes
0answers
73 views

arp poisoning and mitm protection [closed]

I'm trying to understand mitm by arp poisoning. To do so I'm practicing on the network I manage: attacker : IPA victim : IPC gateway : IPG I use nighthawk, and kali linux (via virtual box). I can ...
2
votes
0answers
377 views

Keepalived failover not working for Static NAT target behind Cisco ASA

I've got a Cisco ASA[0] with a pair of Linux boxes in the DMZ running Keepalived and HAproxy acting as a load-balancing failover pair for another pair of Windows servers, also in the DMZ. I'm ...
2
votes
0answers
265 views

I am not able to connect to my server from my leased line internet connection

I am having some troubles connecting to my Fedora server from my static IP ISP connection. Usually I can ping that server with no problems. But other times it just gives me timeout responses. When ...
2
votes
0answers
225 views

Solaris 10 invalid ARP requests from 0.0.0.0? Link up/down every hour or 2

The guys at the data center where I'm hosting a server running Solaris 10 are telling me that my server is making a lot of invalid arp requests. This is an example of a portion of what was sent to me ...
2
votes
0answers
75 views

ipwatchd detects non-existing conflict?

Ipwatchd is telling me about a conflict that I just do not understand. As far as I can tell, there is no conflict. Am I reading the message wrong? It's a Xen machine with the following network ...
2
votes
0answers
117 views

Can ARP with IP aliases on Windows be made to behave like on Unix?

On FreeBSD, when I have one interface with two IPs: ifconfig nic0 192.168.0.1 netmask 255.255.255.0 ifconfig nic0 alias 192.168.0.2 netmask 255.255.255.255 If I ping the alias, if the host I'm ...
2
votes
2answers
538 views

pfSense 1.2.3 can't talk ARP beyond a switch two hops away

I have the following devices on vlan93 on my network: pfsense (192.168.93.1) core-sw1 (192.168.93.2) edge-sw1 (192.168.93.3) pf-switch (192.168.93.100) devices (192.168.93.120) Physical ...
1
vote
5answers
1k views

Bypassing VLAN with known MAC address

I am evaluating subneting our network with a Layer 2 switch and VLAN. From what I know, VLAN only works on broadcast domain, and if I know the MAC address of a remote computer on the same switch, I ...
1
vote
3answers
2k views

Switch behavior on unicast packets when the destination is unknown

Please let me start by saying I am no network expert, I am a programmer who does a fair amount of L3/4 programming. My question is that when a switch receives a packet with a destination MAC that is ...
1
vote
3answers
802 views

Best method and tools for local IP scanning [closed]

I’m starting to administer a small but confusing und badly documented local heterogeneous network (mostly Windows workstations, printers, laboratory equipment, etc. and one Linux/Samba Server) ...
1
vote
2answers
1k views

Protection from ARP spoofing

I'm running Linux and I know my gateway will always be 192.168.1.254 with MAC address aa:aa:aa:aa:aa:aa. Is there any way I can instruct my machine to only ever use this MAC address for the gateway ...
1
vote
2answers
2k views

Bad ARP Cache static entries

I have a weird issue that popped up on our network. Once or twice a week a user (it's always a different user) would complain about not being able to communicate to our Small Business Server 2003 ...
1
vote
2answers
954 views

Where is the arp_cleanup_interval variable in Solaris 11?

In Solaris 10 I can configure (and audit) the arp_cleanup_interval variable using the following command: $ ndd -get /dev/arp arp_cleanup_interval 300000 In Solaris 11 (Express and Release) the same ...
1
vote
4answers
2k views

Block ARP on Router

Is it possible to somehow block ARP on a home wireless network router? Basically I don't want the access point to forward ARP packets between clients. It would also be fine if the access point ...
1
vote
3answers
454 views

Scanning network devices by mac address

I work in the security devices industry and most of my work relates to IP cameras. Each camera manufacturer has their own software that scans the network for their cameras and gives details about ...
1
vote
2answers
329 views

How is a TCP request routed from a virtual machine to an outside resource and back again?

Scenario: Computer A has a local ip of 192.168.1.100, which is running a VM inside of it. The VM now makes a tcp request to an external IP address (74.125.225.98). Could someone explain how the ...
1
vote
2answers
522 views

iPads cause arp-scan duplicate reports, why?

I have a situation like this: Isolated Gigabit Ethernet LAN with a handful of Linux boxes and Macs on it Airport Extreme wireless access point is also connected to the LAN Two iPads talking to the ...
1
vote
2answers
334 views

Is Windows Server 2008 R2 arp cache per user or per machine?

When running arp -a in a Windows Server 2008 R2 prompt, will the returned entries cover connections from all users logged on to the machine or only the current?
1
vote
2answers
517 views

Can a duplicate computer name be known before attempting to join the domain?

Techs in the field are deploying windows 7 pcs onto a domain. They complete one entry screen, which should give them a unique computer name. However, they are human and end up giving the pcs the ...
1
vote
1answer
90 views

Can arping by IP but not MAC address

I have an interface that I can arping to by its IP, but not its MAC address: # arping -i eth2 10.10.0.153 ARPING 10.10.0.153 60 bytes from 02:68:b3:29:da:98 (10.10.0.153): index=0 time=81.062 usec 60 ...
1
vote
1answer
1k views

How can I find out the source of arp request if it is in another subnet?

Our subnet is connected with other subnets with router. Using wireshark I see some arp requests coming to ip addresses of our subnet from the router. Such as Broadcast ARP 60 Who has ...
1
vote
1answer
45 views

Not sending an ARP request to avoid IP conflict

I am working on Ubuntu. I am setting a static IPv4 for my wireless interface (ifconfig wlan0 192.168.1.2) and connecting to a Wireless Access point and pinging it. I don't see in the sniffer that ...
1
vote
2answers
2k views

Broadcom Advanced Control Suite 4 on a PowerConnect 2848 making router (ASA5505) throw ARP errors when TEAMING (different MAC addresses from same IP)

For some reason the Broadcom Advanced Control Suite 4 seems to be a little buggy OR I have not configured something correctly. I have 4 Gb NICs and I team 3 of them to make a virtual adaptor... ...
1
vote
2answers
254 views

Find IP address from a MAC address

Is there anyway to find the IP address of a MAC address using a command? I was thinking something like arping might work but can't seem to find much information on it.
1
vote
1answer
236 views

How to force a host to not send a broadcast for an IP address in its own subnet?

For a LAN, instead of a switch, I have built a topology where each machine is connected to a router. Each host is assigned an IP address from 10/8. Here are the interface details: Lets say I ping ...
1
vote
2answers
1k views

Windows Domain controller ARPing for 169.254.0.0/16 addresses

I've been doing some sniffing on my company's network to try to clean up some of traffic and have noticed that one of our Server 2008 Domain Controllers is sending out ARP's every second or two to ...
1
vote
2answers
4k views

Physical switch not learning MAC address of virtual machines

I have a virtual environment running vSphere 5.1. I have two ESXis with a vDS between them. There is, for the purposes of the discussion, just one portgroup on that vDS configured to use a VLAN. The ...
1
vote
1answer
799 views

Using arpwatch to backtrack proxy access ip to eap-tls certificate

In my network I am using eap-tls authentication (machine certificates) for clients. Those clients are using a squid proxy to access the internet. The proxy is logging the request to the access.log. ...
1
vote
2answers
1k views

arp failing after heartbeat failover occurs

I have an LVS based load balancer which has been working just fine. It runs on two servers using heartbeat to provide failover. I've added support for a second IP range to the system, but when the ...
1
vote
1answer
279 views

How to prevent response to who-has requests on virtual eth interface?

we use small embedded X86 linux servers equipped with a single physical ethernet port as a gateway for an IP video surveillance application. Each downstream IP cam is mapped to a separate virtual IP ...
1
vote
1answer
107 views

ARP Request Being Sent To Different Subnet From Ubuntu Linux

This question is very similar to this one: Linux is sending ARP requests to hosts in other subnets? Main problem - Ubuntu Linux server is sending ARP requests asking for a MAC address of a host on a ...
1
vote
1answer
89 views

Why ARP cache is not emptied as I except it to be?

I'm trying to empirically test the time an entry stays in the ARP cache table. This time seems to be defined by /proc/sys/net/ipv4/neigh/default/gc_stale_time file and by ...
1
vote
2answers
272 views

Arp request for a non-existing host in a local network

I'm wondering why I get the following result : if I try to access a non-existing host on my local network, for instance using the command ping, I see with the tcpdump arp command that there is every ...
1
vote
1answer
2k views

How to reverse arp using nping for Windows

I would like to send a reverse ARP to resolve an IP address given a MAC address using nping for Windows. The documentation is not clear on how this should work and I'm unable to find any examples ...
1
vote
1answer
169 views

iptables arp compare and execute

EXAMPLE: iptables :internet - [0:0] -A internet -m mac --mac-source 48:5D:60:FC:29:B0 -j RETURN COMMIT [root@localhost:~ ] $ arp Address HWtype HWaddress Flags Mask ...
1
vote
1answer
119 views

Move IP from one server to another without disruption

I have an internal DNS server running on a VM. I've rebuilt the server from scratch in a new VM, and I want to cut over from the old to the new at some point. In order to do this, I'll need to take ...
1
vote
2answers
582 views

How to capture arp table when using network bridging?

I have a computer with 2 NICS that are bridged and I need a means of distinguishing between machines connected to eth0 from machines connected to eth1. I was hoping to use something like the "arp -a" ...
1
vote
1answer
1k views

Permanant ARP entries become Unresolved

We have a solution where a number of Solaris servers are in a private VLAN and no arp proxies exist in this VLAN, so to reach neighboring servers we must add static arp entries. Each other server in ...
1
vote
1answer
139 views

How to decrease linux box arp response?

I had known that I can not stop arp flood from others, so I wonder to know how can I decrease the response times per second, so that my cpu wont cost too much for arp flood, any tips?
1
vote
1answer
983 views

What is the effect of stale ARP cache entry on traffic to that DIP till the entry ages out of the ARP table?

If the host, for which an ARP table entry is present on the connected router, has changed its NIC(so that its MAC address has changed), what will happen when a packet is sent out on the link with the ...
1
vote
1answer
1k views

Linux: arp cache timeout for non existent hosts?

In Linux, is there a different arp cache timeout for non existent hosts? At my router, 192.168.0.1, i'm seeing aprox. 8 new entries every 10 seconds for an IP that has been down for a long time. ...