Questions tagged [arp]

Address Resolution Protocol is a layer 2 networking protocol used for resolving layer 3 addresses (such as IP addresses) into layer 2 addresses (such as Ethernet MACs). It is used by network devices when communicating with devices on the same layer 2 network.

Filter by
Sorted by
Tagged with
1
vote
1answer
45 views

Same IP on two NICs half the traffic is lost

I have a machine connected to a slightly broken scientific instrument and I'm trying to work around the problems. The link is point to point, 2x25G ethernet, no other devices involved. The device ...
1
vote
1answer
683 views

Is there is any tool/way to find out why packet is getting dropped due to an arp cache full?

My developer hypothesis is packet is getting dropped at arp layer. We increased the default value of neigh.default.gc_thresh3 1024 --> 2048 and now everything looks good. But I want to understand is ...
0
votes
1answer
38 views

Router ignores ARP response from linux

I have just viewed my local network traffic with Wireshark to solve a connection problem of another device. I noticed that my router constantly asks for my MAC address via ARP, but ignores the answers ...
0
votes
1answer
49 views

High bandwidth ARP traffic on LAN interfaces

I'm using a PfSense Firewall with a few VLANs since over 4 years and in the last couple of days I've noticed network connectivity issues in two of the VLANs. Using the web interface I'm seeing ...
0
votes
0answers
45 views

Debian / Kerio is ARP storming my ISP after loosing connection to the gateway

The problem: after Kerio Control (Debian) lost connection to the gateway it starts sending ARP like for "who has 8.8.8.8?" in such frequency, that the gateway gets shut down due to packet inspection ...
1
vote
1answer
145 views

QEMU/KVM/libvirt macvtap VEPA not working - ARP request not forward

Hi I've been struggling to get guest networking working when using a macvtap in VEPA mode between two VMs on a host. I've spent hours (days) googling with no joy. Does this network configuration ...
1
vote
1answer
236 views

Why Nmap doesn't arp-scan find any devices when does?

When I run nmap -sn 192.168.0.0/24 I get the result: Nmap scan report for 192.168.0.1 host is up (0.16s latency). Nmap scan report for 192.168.0.103 host is up (0.19s latency). Nmap scan report for ...
2
votes
0answers
46 views

NIC bonding on Linux in redundant network topology

I want to implement NIC bonding on Linux server in redundant network topology as shown in the network diagram below. Network topology Both interfaces of the Linux server fa0 and fa1 would be in one ...
2
votes
1answer
102 views

Why do some unknown hosts show up with nmap option-sL , and not with -sn [and do I need to worry about them]?

Initial Disclosure I am not a network engineer and my expertise in this area is low. Background while using nmap 7.70 with nmap -sL to look for the IP address of a known device on our local ...
0
votes
2answers
63 views

Feasibility of having two independent subnetworks on interconnected switches

I have the following setup, using two standard cheap switches that are interconnected by a long Ethernet cable: |------ SWITCH #1 | [ ] Equipment with public IP 217.x.x.101 (subnet 217.x.x.96/29) | [ ...
0
votes
0answers
87 views

Ping between two interfaces on one host

I'm trying to setup a test environment for a network equipment. I need to be able to ping (or establish tcp connection) between different interfaces on single host. Unfortunately I am not able to ping ...
0
votes
0answers
21 views

What happens when a loopback interface is misconfigured as Class-C IP?

A rogue server was found to answer each and every ARP requests, effectually blocking any new hosts to join the broadcast domain (192.168/16) of its ethernet interface. Later it was found that the ...
0
votes
0answers
50 views

Probe Delay on Nexus

Question: What are the equivalent Cisco Nexus IOS commands for these IOS commands? ip device tracking probe delay 10 no ip gratuitous-arps Note: These commands work on Cisco 3650 switches. ...
0
votes
0answers
33 views

Devices in same vlan cannot ping each other - Possible ARP Issue

The environment is running with Nexus 9K in NXOS mode. Both are in vPC mode and running hsrp with N9K1 active and N9K2 standby. Due to vPC both nodes are running Active/Active for HSRP. Now the ...
0
votes
1answer
35 views

Industrial switches failing to pass broadcast traffic/ARP requests very slow

I'm dealing with some industrial Ethernet switches (Phoenix Contact FL Switch SF 16TX) which are connected to about 5 computers and 5 SLC/5 PLCs. We are having an issue where ARP requests are not ...
0
votes
0answers
46 views

Behavior of ARP when using VPN bridge

I'm experiencing trouble connecting infrastructure using VPN. i don't have lots of rights with the VM i'm using so it's hard to give you précision, so this topic should be theoretical. There is 3 ...
0
votes
0answers
63 views

Can adding a fake arp entry send the traffic over a wire to an external interface?

I am trying to run a self test of a PMC card that has two interfaces. My operating system is Vxworks 5.5. I have read different solutions in this forum like use of network namespaces, use of fake ...
1
vote
2answers
41 views

Too much ARP 60 Packets and Network is getting very slow

I am seeing too much ARP 60 packets from one IP in wireshark. Our LAN is getting too slow, But the internet is working fine without any issues. But cant access local printers, file share etc Am ...
0
votes
0answers
333 views

Setting up Linux bridge for all VLANs (tagged) when bridges for same VLANs (untagged) exist

TL;DR: Does anyone know how to get bridges associated with a VLAN (like virbr0.101) and a generic bridge that supports all VLANs (like virbr0) to co-exist? Sorry for the rambling backstory, but I'm ...
0
votes
1answer
64 views

Manually building an ARP table

I am using a real time operating system called Vxworks 5.5. The address resolution protocol is disabled and now I need to build up an ARP table manually to initiate IP to IP communication. The IP ...
0
votes
1answer
104 views

Docker Linux network topology using route tables and arp

I'm working with a network of docker containers. C1's routing table is below, it's default gateway 172.17.0.1 is the docker bridge. It's eth1 interface is connected to eth2 in C2 and it routes all ...
1
vote
1answer
93 views

Windows 2012 R2 Domain Controller making ARP requests outside of subnet?

I have a Windows Server 2012 R2 box acting as a Domain Controller which is on a segregated LAN. It also acts as the DNS server for this LAN. I also have a Sonicwall NSA 2600 firewall which is set as ...
0
votes
0answers
29 views

Respond to an ARP request on interface with mac address of default gateway

I'm running a macOSX and am sharing my internet using the native 'internet sharing' functionality from an ethernet port on my macOSX to the wifi. I connected my windows pc to the WiFi hotspot and ...
1
vote
1answer
86 views

Can I use source MAC of Ethernet packet for UDP reply instead of ARP lookup?

I'm working on an embedded platform with very limited resources where I need to build my own Ethernet frames. If I need to answer a UDP request with a UDP reply, is it ever not OK to just send the ...
1
vote
0answers
197 views

nmbd “Packet send failed” error

I'm desperately trying to get folder sharing over SMB working on my local network. I'm running up-to-date arch linux and connecting over wifi using wicd. I have latest samba installed (4.10.4). While ...
0
votes
0answers
39 views

arpwatch: Filter specific entry/IP in subnet?

I started using arpwatch to monitor changes of ARP entries on a subnet. I enabled the mail reporting and it is working greatly. The thing is I'm focused on getting notifications about specific MAC ...
0
votes
0answers
186 views

Permanent ARP entry failed

This has happened twice now and I'd really like to know why and how to prevent it. In our OpenWRT router, I add a permanent ARP entry on startup like so: ip neigh add 192.168.0.254 lladdr ff:ff:ff:ff:...
1
vote
1answer
118 views

How to fix the network after ARP poisoning attack?

I was running a program called morpheus: https://github.com/r00t-3xp10it/morpheus. It is a github project which allows ARP poisoning attacks, MITM attacks etc. I was running a arp spoofing/phishing ...
3
votes
2answers
644 views

“No route to host” until “ping” or “route”

I have two computers in one WiFi network: A - client B - server Sometimes (once in ten times) after B reboot I am unable to ssh from A to B: $ ssh 192.168.201.128 ssh: connect to host 192.168.201....
0
votes
0answers
169 views

arp-scan with virtual interface

I use eth0 for 192.168.1.0/24 network and virtual interface eth0:0 for 192.168.2.0/24 network. I want to be able to scan both networks with arp-scan. I have the following ip configuration : 2: eth0:...
0
votes
0answers
129 views

Lost IP on virsh created centos VMs

Created two CentOS 7.4 test VMs, after running for several days observed one of the VM test-vm1 lost its IP when check via virsh domifaddr. [root@worker ~]virsh domifaddr test-vm1 Name MAC ...
0
votes
0answers
118 views

ARP Poisoning on WPA2 Network

On wireless network running under WPA2 protocol, the communication between a client and the AP is encrypted using a session key (calling it that way, but if there's a more exact term I'd be glad to ...
0
votes
1answer
404 views

how to set skb->priority of ARP packets

As the title already specifies, I'm looking for a way to set the linux skb->priority of outgoing ARP packets of a given interface on my linux machine that is used as a router. The skb priority is ...
0
votes
2answers
130 views

Arping does not work in a script

In my network I have one linux host as a default gateway located at 192.168.150.1. On another host at 192.168.150.4 I have this script to measure time between sending an arp request and receiving it: ...
0
votes
0answers
14 views

Some nodes of network send same ARP requests several times, also on inexistent IP addresses. Is this ARP flood?

I have been monitoring local network with Wireshark to increase its speed. And I do occasionally notice strange behavior: Log from Wireshark As you can see, 192.168.0.127 sometimes wants to know who ...
1
vote
1answer
103 views

Linux: answer arp instead of the kernel?

Is it possible to answer ARP requests in user mode instead of inside the kernel? I can create a ETH_P_ARP socket but not sure if I can completely replace the kernel strategy at this level.
0
votes
1answer
390 views

ARP table not updated until response is sent

I'm executing the arp -a command on CentOS 7 in order to translate an IP address to a MAC address (since I can't access the source MAC of the layer 2 frame in Java). I see a lot of cases where the ...
0
votes
1answer
470 views

VPN Router does not reply to ARP Requests

So i have these three network interfaces setup on a linux box: eth0 is facing the external network (192.168.1.0/24) tun0 is the vpn interface (10.8.8.0/24) eth1 is the local network interface (...
1
vote
0answers
626 views

How do I make Arpwatch only send new activity/new station emails?

I had set up Arpwatch on my office's pfSense 2.4.3 gateway. Ever since I had done that, I started getting a whole lot of emails - most of them very useful, while some are less useful. I wonder if ...
1
vote
0answers
176 views

Weird answer of linux DHCP server to gratitious ARP causes DHCP failure

This is a problem, that I ran into recently on a quite heavily configured linux server. This machine runs Samba as an Active Directory Domain Controller, a mail server, a web server, two virtual ...
0
votes
1answer
447 views

How do I add a persistent static ARP entry to an AIX server?

How do I add a persistent static ARP entry to an AIX server? /> uname -a AIX CBDIS 3 5 000B8886D700 /> uname -v 5 /> uname -r 3 />
0
votes
1answer
88 views

Get-NetNeighbor for other routers in various sites (Determining active devices connected)

First post here, usually partial to StackOverflow, but this isn't exactly code related so I figured I'd drop here. I'm looking to get the arp table of routers within our network at various sites. I'm ...
0
votes
1answer
173 views

Martian source messages on most of the servers inside a network

On Ubuntu 16.04 and 18.04 servers, in the /var/log/syslog file, there are often Martian source messages like: Aug 23 06:42:51 scilit-solr kernel: [5417098.171549] IPv4: martian source 255.255.255.255 ...
0
votes
1answer
54 views

New computers can't connect to the network

Good Morning, We have a business environment in which we have 3 Cisco 3850 PoE stacked and We manage our DHCP through our DC server. Last weekend our UPS had a failure and switched off all outputs, ...
0
votes
1answer
789 views

possibly excessive arp traffic related to network slowdown

I was looking into reports at one of my customers that the "network" was slow. (File access/saving/image loading from the server taking longer than than it usually does). The basic setup is a ...
2
votes
0answers
33 views

Does Loopback able to support all TCP/IP protocols

Does a Windows loopback adapter supports ACD and duplicate IPs. Say we have a code that supports full TCP stack and we bridge the program to loopback using PCAP. If in case I set both the address ...
0
votes
2answers
302 views

Windows Loopback adapter not participating in local network

I have created a Windows loop back adapter with 'Obtain IP address Automatically' enabled. ipconfig /all Ethernet adapter LL Address: Connection-specific DNS Suffix . : Description . . . . ....
0
votes
0answers
78 views

Sending ARP requests with SmokePing

I have been using SmokePing to monitor my local network for some time now and I'm happy with its graphs and email alerts. I use the fping probe and it works as expected. I found however that, every ...
0
votes
1answer
239 views

How does ARP resolution work on Windows

This question was originally posted on the Network Engineering SE site, but closed for being off-topic. I've stumbled upon a peculiar behavior of Windows hosts in our network. Our clients are mostly ...
2
votes
2answers
108 views

Preventing ARP reply messages for IP address from unauthorized port/mac

I have a number of servers running on Dell switches which are used by clients for their projects. Occasionally some clients put other client IP addresses on their server (presumably by accident) and ...

1 2 3 4 5 8