I have a 2901 between a network and the internet. It shipped with the routing defined as follows.

ip route GigabitEthernet0/1

Using the interface like this instead of an IP struck me odd when it came in, but we didn't change it.

We've been having mallocfail errors, which I traced back to the "IP ARP Adjacency" process. A show arp comes back with 60,000+ entries. That would explain the memory consumption and poor performance but I'm not 100% sure as to why this is happening.

I've seen a few references that if you use an interface name it results in needing to resolve every IP to the MAC to use for the next hop.

Is that what is happening here? How can I tell?


show arp comes back with 60,000+ entries. That would explain the memory consumption and poor performance but I'm not 100% sure as to why this is happening.

When you configured ip route GigabitEthernet0/1, you effectively told the router that you have directly connected the entire internet to GigabitEthernet 0/1. Your router believes you, so it must send an ARP request for each new destination IP address following that default.

If the next hop router is configured with proxy-ARP (default config on Cisco routers), then this actually "works" until one of the routers hits resource exhaustion as yours did. Both routers could run out of CPU (from ARP processing), but only your router could hit a memory limitation due to the massive ARP cache. I normally disable proxy-ARP on interfaces to ensure my routers won't participate in misconfigurations like this.

The simple solution on your side is configuring an explicit IP next hop instead of pointing out the interface. If you had a masochistic streak, you could leave the route as-is and play ARP timeout games to stave off memory exhaustion, but one should never play games like that on production networks.

Default routing to an ethernet interface is bad news; every network engineer makes this mistake once. I learned the same way myself. If you're really unfortunate, the reason your ARP table is full is because something (ie a virus) decides to scan the whole internet for victims.

  • That's exactly what I came up with. The sad thing is Sprint provoked that router to us with the wrong config. That'll teach me to believe the vendor knows more then I. Nov 13 '14 at 20:36
  • And it's only made worse by the trillions of examples all over the internet showing this as "the way to do it".
    – Ricky
    Nov 13 '14 at 21:55
  • His ARP table is full because it's a router -- default ARP timeout is 4 HOURS. How many hosts does a typical network contact in 4hrs.
    – Ricky
    Nov 13 '14 at 21:58
  • RE: "how many hosts does a typical network contact"? I will be a little pedantic, and point out that saying "typical network" is like saying "typical rock". They aren't the same size / color, etc. Overall, I agree that many networks will contact 60,000 unique hosts within 4 hours...
    – This
    Nov 13 '14 at 23:03
  • 1
    Whenever I hear about proxy-arp issues, I just giggle a little bit inside. "I normally disable proxy-ARP" I couldn't agree more with this. I don't believe I've ever come across a situation where proxy-arp was a necessity. IMHO, it just permits misconfigurations.
    – Ryan Foley
    Nov 14 '14 at 17:34

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.