Address Resolution Protocol is a layer 2 networking protocol used for resolving layer 3 addresses (such as IP addresses) into layer 2 addresses (such as Ethernet MACs). It is used by network devices when communicating with devices on the same layer 2 network.
35
votes
6answers
4k views
Windows 2008 ignores Gratuitous ARP requests
We recently saw an issue after a fail over of our router where our Windows 2008 Boxes didn't start talking to the primary router after fail-back.
When we did some digging they still had the ARP ...
16
votes
16answers
109k views
How to get a list of all IP addresses (and ideally device names) on a LAN?
Our network gave an error that there was an IP address conflict and I'd like to find what all the device IP addresses are. (I've also had need of that before). (update/clarification:I'm looking for a ...
12
votes
5answers
20k views
Ubuntu Linux - multiple NICs, same LAN… ARP responses always go out a single NIC
We've got AT&T U-Verse internet service, which has an extremely boneheaded DSL gateway.
We have 5 IPs (netmask 248), but the gateway is incapable of doing anything other than a single IP -> ...
12
votes
2answers
2k views
Machine always responds to 192.168.1.2 IP address, which is not set on the machine
UPDATE BELOW:
UPDATE 2 BELOW: FINAL Solution
I have a brand new HP EliteBook notebook 8560p running Windows 7 64bit. I plug it into a small Dlink di-604 router, it is currently configured with DHCP ...
12
votes
2answers
3k views
Strange: why does linux respond to ping with ARP request after last ping reply?
I (and a colleague) have just noticed, and tested, that when a Linux machine is pinged, after the last ping it initiates a unicast ARP request to the machine that initiated the ICMP ping. When pinging ...
11
votes
1answer
483 views
arp-requests cannot be seen by specific nodes
I create an open ad-hoc wlan by using iwconfig (I have the same issue with wpa_supplicant as well). there are 4 nodes on the network as seen on the figure below. The nodes run ubuntu 12.04 and debian ...
9
votes
8answers
35k views
Is there any way to ARP ping on Windows?
On Linux and other systems, there is an utility called arping which can be used to send ARP requests ("pings") and show the answers, much like the "ping" utility but using ARP instead of ICMP.
Is ...
9
votes
5answers
5k views
ARP replies contain wrong MAC address
I've got a robot running linux with wired and wireless adapters. When I boot up, it connects to the wireless fine. When I assign an IP to the wired (either statically or with DHCP), it looks like it ...
8
votes
3answers
6k views
How to broadcast ARP update to all neighbors in Linux?
Some clients in the subnet has cached the IP with old MAC address, I want them to update the new value by doing a ARP broadcast, is it possible in Linux?
8
votes
4answers
521 views
Network throughput issue (ARP-related)
The small college where I work is having some very strange network issues. I'm looking for any advice or ideas here. We were fine over the summer, but the trouble began few days after students ...
7
votes
2answers
2k views
NIC Teaming with Broadcom on HyperV 2008 R2
I have a HyperV cluster made up of 3 hosts. Each host is connected to both of my Nexus 5548 switches running in an etherchannel. LACP on the switch and NIC teaming using Broadcom 802.3ad on the server ...
6
votes
7answers
10k views
Is it possible to match an internal IP address to a switch port?
I'm trying to find a computer that has a certain IP address on our internal network. I have identified the computer name from DNS, but in this case it does not help me.
Just wondering if I can ...
6
votes
5answers
2k views
Cluster failover and strange gratuitous arp behavior
I am experiencing a strange Windows 2008R2 cluster related issue that is bothering me. I feel that I have come close as to what the issue is, but still don't fully understand what is happening.
I ...
6
votes
1answer
336 views
Random and Selective ARP blindness in VMWare ESXi 4.1
We have multiple VMWare ESX servers spread out amongst our company, doing various tasks. One particular ESXi host is exhibiting very peculiar behavior. We detect it when our monitoring system ...
5
votes
1answer
263 views
Which NIC have the IP address?
If I have two NICs where I know the MAC addresses.
Without logging into the server, how do I figure out which have the IP address 10.10.10.10?
Can arp somehow be used for this?
5
votes
4answers
3k views
How to find the process which causes the arp request?
When i run tcpdump in the gateway, i get a lot of arp requests originating from the gateway itself. I wonder know why this happens. How can i find the process that causes these arp requests?
$ ...
5
votes
2answers
672 views
linux routing bug?
I have been struggling with this not easily reproducible issue since a while. I am using linux kernel v3.1.0, and sometimes routing to a few IP addresses does not work.
What seems to happen is that ...
5
votes
3answers
2k views
Windows 2008 R2 Servers Sending Arp Requests for IPs outside Subnet
By running a packet capture on my my routers I see some of my servers sending ARP requests for IPs that exist outside of its network.
For example if my network is:
Network: 8.8.8.0/24
Gateway: ...
5
votes
1answer
843 views
How do I poll the ARP table with an SNMP OID?
When you need to poll the ARP table of a device, conventional wisdom is to use ipNetToMediaPhysAddress or atPhysAddress; however, both of these OIDs are deprecated according to Cisco's documentation.
...
5
votes
1answer
93 views
Sender Information Not Cached on the Receiver During an ARP Request
I'm currently trying to get my head around more advanced networking concepts. The way I am doing this is by going on one of the servers I look after as a sysadmin and running network captures to see ...
5
votes
2answers
266 views
Ubuntu 12 crashed and took down network
We recently set up a new Ubuntu 12.04LTS server on our network. It's not fully configured so it's not doing much beyond sshd and a default apache2 install. But this evening it appears to have ...
4
votes
2answers
2k views
Why my laptop sends ARP request to itself?
I have just started to learn about protocols. While studying the packets in wireshark, I came across a ARP request sent by my machine to my own IP. Here is the details of the packet :
No. Time ...
4
votes
1answer
60 views
tcpdump on interface when pinging nonexistent hosts on local network
I've statically configured the IP address of an interface on a server:
ip addr add 10.40.0.6/16 broadcast 10.40.255.255 dev eth1
If I try to ping a machine on the network (e.g., 10.40.0.1), it ...
4
votes
4answers
8k views
Clearing ARP cache on ESXi 4.1
We recently migrated our entire VMware cluster from ESX over to ESXi. For the most part, the transition was seamless, and I haven't missed having access to the SC. Until now.
We're trying to diagnose ...
4
votes
3answers
2k views
How to configure remote access to multiple subnets behind a SonicWALL NSA 2400
I have a client that uses a SonicWALL NSA 2400 as their firewall. I need to setup a second LAN subnet for a handful of PC. Management has decided that there should be a second subnet even though ...
4
votes
1answer
448 views
Arp requests with odd source IP go unanswered
I'm having a server with network connectivity issues that I presume come from issues with arp protocol handling.
Let's say the network topology is as follows:
network 192.168.106.0, netmask ...
3
votes
4answers
619 views
What happens if I ask 127.0.0.1 via arp broadcasting?
Will all the computers on the network will answer me?
3
votes
2answers
2k views
how can I stop my sonicwall TZ-210 (SonicOS Enhanced 5.5.1.0-5o) from responding to arp queries on the wan subnet?
My sonicwall TZ-210 is answering arp queries on the wan subnet (which my isp doesn't like), basically mapping all the wan ips to its own mac address, causing network havoc since it is not set to route ...
3
votes
2answers
173 views
Windows 7 Requires ARP for UDP?
Seems like my Windows 7 box (with 2 NICs if that's relevant) requires an ARP response before it sends packets to a certain IP address. The specific context I'm in is running a TFTP server (TFTPD32). ...
3
votes
1answer
1k views
Wireshark arp packets
In wireshark, after capturing some arp packets, what is the significance of all 1's in the destination field. of an Ethernet II frame?
3
votes
3answers
12k views
How can I fix a bad arp entry?
I'm just guessing that arp is my problem...
I have a linux drbd server cluster set up, and due to some power issues had to unplug the switch that connects the two servers. As a result, both servers ...
3
votes
1answer
525 views
pfsense single MAC is listed with several IP's in ARP table
I have this problem:
arp table filling up
But I am quite sure that I cannot blame Kaspersky.
Scenarie:
a user plugs his computer in.
He waits and waits but are getting no IP by DHCP.
Then he is ...
3
votes
3answers
10k views
How to prevent / detect ARP poison rooting attacks?
Although we have not had any first-hand experience with these kind of attacks (as far as we know of) I would like to know how to prevent them from happening as much as possible. I mostly use my ...
3
votes
1answer
1k views
How to test 10 gigabit Intel X520 on Ubuntu
I got Intel X520 and connected it to PCI-E x16. The card is recognized as 10 Gbit by ethtool:
# ethtool eth5
Settings for eth5:
Supported ports: [ FIBRE ]
Supported link modes: ...
3
votes
0answers
183 views
Dynamic ARP Entries turning into Static ARP entries
I recently acquired a client that has a strange ARP caching issue on one of thier servers.
I have a server that will eventually start turning it's dynamic ARP entries into static ARP entries. This ...
2
votes
4answers
279 views
ARP packets never routed?
is it true ARP only works in single broadcast domain and arp packets are not routed frm 1 network to another ?
can any one give me any example or any source of info for this
hoping for positive ...
2
votes
2answers
207 views
Why computer scanning network?
I have found out through Wireshark that a computer in my subnet scanning network ( sending ARPs for every IP-address in my subnet. Even if there no computers with such address).
It repeats ...
2
votes
2answers
1k views
2 NICs 2 IPS same subnet
I am setting up a SUSE 11 box that has two NICs:
eth0 - 192.168.10.150/24 - 00.0C.29.DC.10.CA (MAC)
eth1 - 192.168.10.151/24 - 00.0C.29.DC.10.DE (MAC)
I need both in the same subnet since they will ...
2
votes
2answers
96 views
What happens if two machines respond to an ARP “who is” request?
I am only recently learning about the nuances of networking, but if a malicious user responded to an ARP "who is" when they should not have, what happens?
2
votes
5answers
813 views
A strange arp issue
I have a problem with one of our solaris servers, an arp table entry is changing every so often for one of the other servers (WINSERVER) on the network.
It will start out with the correct MAC address ...
2
votes
1answer
95 views
arp --detete is not deleting an entry; merely marks entry as “incomplete”
I run arp --delete and it leaves the entry but it's simply marked as incomplete. I expected --delete to entirely remove the entry.
Does anyone understand what is occurring here?
$ sudo arp -avn
? ...
2
votes
1answer
1k views
Why ARP request is unicast?
I have a wireshark capture here that indicating a unicast ARP request from source to destination. As per my understanding ARP requests (including gratutious ARP) use broadcast.
In what case the ...
2
votes
3answers
300 views
Extremely high arp fllooding from the router
My subnet is 10.162.0.0/16.
We have a router with a couple of interfaces.
Gateway for my subnet is 10.162.0.1.
The router is situated in another building and I haven't direct access to it. Line from ...
2
votes
2answers
1k views
How do I prevent excessive ARP requests sent from Windows Server 2003?
OK, I've scoured the 'net already for possible solutions and have found none. Maybe you guys can help me.
I have a Windows Server 2003 setup, with a fixed IP on a routed LAN, standard /24 network.
...
2
votes
2answers
3k views
2
votes
2answers
4k views
Linux bridge responding to arp on wrong interface?
I'm trying to build a silent bridge for monitoring purpose. My computer is running linux 2.6, brctl 1.4 and has 3 NIC:
eth0, with an assigned IP, used for SSH maintenance
eth1, and eth2 , the 2 ...
2
votes
1answer
60 views
ARP/Mac address table
What is the difference between a mac address table and an arp table? Is it correct to say only one arp cache is kept for each switch which self learns to forward information to another host, and every ...
2
votes
2answers
77 views
arp packet received larger than packet sent, why?
I'm trying to debug a networking issue. During this process, I've noticed that when I try to do an arping, the received arp packets are larger than sent arp packets, as outputted by tcpdump.
(Note ...
2
votes
3answers
129 views
arp who-has requests view vlan isolated different addresses (single NIC)
I have debian hosts which are connected through trunk port on 5 different vlans. But this host respond to arp "who-has" requests of all of their differents ip. I wish understand why ...
Here the ...
2
votes
1answer
1k views
Ubuntu Linux - two interfaces, same subnet, different vlan - MAC/ARP issues
I'm attempting to setup a server that needs to have interfaces on the same IP subnet, but different VLANs:
eth1.102 Link encap:Ethernet HWaddr 00:50:56:b1:00:0f
inet addr:10.1.1.6 ...
