Address Resolution Protocol is a layer 2 networking protocol used for resolving layer 3 addresses (such as IP addresses) into layer 2 addresses (such as Ethernet MACs). It is used by network devices when communicating with devices on the same layer 2 network.

learn more… | top users | synonyms

0
votes
2answers
2k views

Linux is not sending arp request

We have a local network that is connected to internet through linux gateway. There are about 50 workstations in LAN. We recently started observing a problem that gateway sporadically stops responding ...
2
votes
2answers
91 views

Need confirmation on layer 2 security question

I need confirmation on a question regarding layer 2 security. I've been doing research and I just need to know that I understand it correctly. Basically, if you have a LAN with a few machines ...
9
votes
6answers
9k views

ARP replies contain wrong MAC address

I've got a robot running linux with wired and wireless adapters. When I boot up, it connects to the wireless fine. When I assign an IP to the wired (either statically or with DHCP), it looks like it ...
2
votes
1answer
5k views

Is it possible to disable ARP in Windows 7

I have a unique requirement where I need to disable ARP on a Windows 7 box. In previous Windows versions you could modify the ArpRetryCount in the registry (and set it to 0), but this does not work in ...
5
votes
3answers
3k views

Windows 2008 R2 Servers Sending Arp Requests for IPs outside Subnet

By running a packet capture on my my routers I see some of my servers sending ARP requests for IPs that exist outside of its network. For example if my network is: Network: 8.8.8.0/24 Gateway: ...
4
votes
2answers
6k views

Clear arp cache

How to clear arp cache ? How to refresh arp table ?
0
votes
2answers
12k views

No answer on arp requests?

I have a problem where my Layer 3 Dell PowerConnect 6248 Switch (main switch) will sometimes (that means sometimes it works, sometimes it won't) not get an arp response from a device behind Dell ...
0
votes
3answers
2k views

Same native and tagged vlan possible on Redhat?

I'm looking at implementing a systems using a number of tagged and a native vlan connected to a server over a a/p bonded interface. The untagged vlan is for physical machine access, the tagged vlans ...
0
votes
2answers
1k views

Ettercap - packet injection / alteration

So I have a proxy setup using squid on port 3128. I also have ettercap setup. My main goal is to change data as it flows through my proxy. Basically, you open up www.something.com using my ...
5
votes
2answers
4k views

Why my laptop sends ARP request to itself?

I have just started to learn about protocols. While studying the packets in wireshark, I came across a ARP request sent by my machine to my own IP. Here is the details of the packet : No. Time ...
0
votes
5answers
744 views

Computers on one subnet can't connect to the internet

I have an issue with my student computers - they can't connect to the internet. Here's the weird part: I open a command prompt and ping our gateway server, and suddenly everything is fine (at least ...
4
votes
2answers
3k views

Is it possible to use proxy-arp back to the same interface?

I have a WiFi Access Point connected to a Linux Router. The Router is itself connected to the Internet. For multiple reasons (mostly to control security and quality of service), I want to force all ...
2
votes
4answers
488 views

ARP packets never routed?

is it true ARP only works in single broadcast domain and arp packets are not routed frm 1 network to another ? can any one give me any example or any source of info for this hoping for positive ...
2
votes
2answers
6k views

Linux bridge responding to arp on wrong interface?

I'm trying to build a silent bridge for monitoring purpose. My computer is running linux 2.6, brctl 1.4 and has 3 NIC: eth0, with an assigned IP, used for SSH maintenance eth1, and eth2 , the 2 ...
0
votes
1answer
577 views

CISCO: ARP Poisoning Countermeasures

How can I prevent the Cisco Catalysts 2950/2960/3550/3750 from being vulnerable to ARP Poisoning? Can this be avoided with the ARP INSPECTION? Thanks
1
vote
1answer
758 views

Using arpwatch to backtrack proxy access ip to eap-tls certificate

In my network I am using eap-tls authentication (machine certificates) for clients. Those clients are using a squid proxy to access the internet. The proxy is logging the request to the access.log. ...
1
vote
1answer
1k views

How are ARP reply collisions typically handled?

If a node receives multiple, conflicting ARP replies, what happens?
4
votes
4answers
10k views

Clearing ARP cache on ESXi 4.1

We recently migrated our entire VMware cluster from ESX over to ESXi. For the most part, the transition was seamless, and I haven't missed having access to the SC. Until now. We're trying to diagnose ...
0
votes
1answer
138 views

arp result interpretation

So what does the command arp -a do? I've been told it displayed the MAC addresses of all network cards on the computer, but when I ran it, it displayed three MACs for three IPs (192.168.41.1, .6, and ...
1
vote
2answers
412 views

Is there a way to trace what's sending gratuitous arps?

We have a box that's just started acting up and we're not really sure why. It has IP address (dummy examples) 199.199.199.1 on eth0, 127.0.0.2 on eth1, and 199.199.199.2 on eth1:0. Recently, for some ...
2
votes
2answers
742 views

Software to Generate False ARP Requests?

A product I'm testing appears to freak out when it receives an ARP request with a Sender IP Address of 0.0.0.0. This is not an ARP probe, as the request is addressed to my module, and the customer's ...
0
votes
1answer
591 views

Two NIC's in the same ip segment

What is the best technical solution to solve this? I have a /24-segment with two NIC's in one Linux Server (lets call it srv) that have two IP-addresses in this segment. NIC1 / eth0 / 10.10.1.101 / ...
11
votes
3answers
22k views

How to broadcast ARP update to all neighbors in Linux?

Some clients in the subnet has cached the IP with old MAC address, I want them to update the new value by doing a ARP broadcast, is it possible in Linux?
4
votes
3answers
6k views

How to configure remote access to multiple subnets behind a SonicWALL NSA 2400

I have a client that uses a SonicWALL NSA 2400 as their firewall. I need to setup a second LAN subnet for a handful of PC. Management has decided that there should be a second subnet even though ...
2
votes
2answers
4k views

No ARP reply on tap0 (KVM bridged networking)

I wanted to assign an external IP address to my KVM guest and went the bridged networking way. Unfortunately the guest has no network connectivity and I don't know why. After investigating it seems ...
1
vote
2answers
1k views

arp failing after heartbeat failover occurs

I have an LVS based load balancer which has been working just fine. It runs on two servers using heartbeat to provide failover. I've added support for a second IP range to the system, but when the ...
1
vote
1answer
263 views

How to prevent response to who-has requests on virtual eth interface?

we use small embedded X86 linux servers equipped with a single physical ethernet port as a gateway for an IP video surveillance application. Each downstream IP cam is mapped to a separate virtual IP ...
0
votes
3answers
350 views

How to stop my VPS from picking up ARP reqs it is not supposed to?

Machine: Xen-3.0 image running stable Debian Linux 2.6.18, pretty vanilla. My VPS provider asks me to deal with some trouble my image is causing, namely handling IP addresses it is not supposed to: ...
1
vote
5answers
1k views

Bypassing VLAN with known MAC address

I am evaluating subneting our network with a Layer 2 switch and VLAN. From what I know, VLAN only works on broadcast domain, and if I know the MAC address of a remote computer on the same switch, I ...
3
votes
1answer
2k views

Wireshark arp packets

In wireshark, after capturing some arp packets, what is the significance of all 1's in the destination field. of an Ethernet II frame?
2
votes
3answers
3k views

Persistent static ARP entries on Windows, is it possible?

I am currently running coLinux configured in "ndis-bridged" networking mode, on a machine whose wireless networking card or driver seems incapable or unwilling to accept non-broadcast layer 2 traffic, ...
1
vote
1answer
328 views

'arp authorized' alternative

Is there another way besides arp authorized command on a cisco router to prevent users from setting static IP addresses on their computers and getting access to the network? Essentially, limiting ...
12
votes
2answers
4k views

Strange: why does linux respond to ping with ARP request after last ping reply?

I (and a colleague) have just noticed, and tested, that when a Linux machine is pinged, after the last ping it initiates a unicast ARP request to the machine that initiated the ICMP ping. When pinging ...
1
vote
4answers
1k views

Block ARP on Router

Is it possible to somehow block ARP on a home wireless network router? Basically I don't want the access point to forward ARP packets between clients. It would also be fine if the access point ...
15
votes
8answers
62k views

Is there any way to ARP ping on Windows?

On Linux and other systems, there is an utility called arping which can be used to send ARP requests ("pings") and show the answers, much like the "ping" utility but using ARP instead of ICMP. Is ...
1
vote
3answers
697 views

Best method and tools for local IP scanning [closed]

I’m starting to administer a small but confusing und badly documented local heterogeneous network (mostly Windows workstations, printers, laboratory equipment, etc. and one Linux/Samba Server) ...
1
vote
2answers
2k views

Bad ARP Cache static entries

I have a weird issue that popped up on our network. Once or twice a week a user (it's always a different user) would complain about not being able to communicate to our Small Business Server 2003 ...
0
votes
6answers
3k views

Network routing issues on Linux

I was hoping someone out there would be able to look at this and let me know what I have missed. I have 4 machines and for some reason, only 1 of them can talk to the other 3 via their private IP ...
2
votes
5answers
943 views

A strange arp issue

I have a problem with one of our solaris servers, an arp table entry is changing every so often for one of the other servers (WINSERVER) on the network. It will start out with the correct MAC address ...
2
votes
5answers
6k views

Cisco WS-C6509-E Arp Cache Corruption Issue?

We are having an issue with our Catalyst 6500 switch where we suspect that the ARP cache is being corrupted. This presents itself with the following symptoms: When you attempt to ping a system which ...
3
votes
4answers
785 views

What happens if I ask 127.0.0.1 via arp broadcasting?

Will all the computers on the network will answer me?
3
votes
3answers
15k views

How can I fix a bad arp entry?

I'm just guessing that arp is my problem... I have a linux drbd server cluster set up, and due to some power issues had to unplug the switch that connects the two servers. As a result, both servers ...
13
votes
5answers
28k views

Ubuntu Linux - multiple NICs, same LAN… ARP responses always go out a single NIC

We've got AT&T U-Verse internet service, which has an extremely boneheaded DSL gateway. We have 5 IPs (netmask 248), but the gateway is incapable of doing anything other than a single IP -> ...
24
votes
13answers
193k views

How to get a list of all IP addresses (and ideally device names) on a LAN?

Our network gave an error that there was an IP address conflict and I'd like to find what all the device IP addresses are. (I've also had need of that before). (update/clarification:I'm looking for a ...
7
votes
6answers
17k views

Is it possible to match an internal IP address to a switch port?

I'm trying to find a computer that has a certain IP address on our internal network. I have identified the computer name from DNS, but in this case it does not help me. Just wondering if I can ...
3
votes
2answers
11k views

How to prevent / detect ARP poison rooting attacks?

Although we have not had any first-hand experience with these kind of attacks (as far as we know of) I would like to know how to prevent them from happening as much as possible. I mostly use my ...