Ports in my network on random switches(connected to Windows 7 workstations) are going into err-disable because of dynamic arp inspection. Ports are going into err-disable because there are too many arp requests packets per second.
Please see output from the log:
Mar 2 13:14:35 EST: %SW_DAI-4-PACKET_RATE_EXCEEDED: 21 packets received in 922 milliseconds on Gi1/0/6. Mar 2 13:14:35 EST: %PM-4-ERR_DISABLE: arp-inspection error detected on Gi1/0/6, putting Gi1/0/6 in err-disable state Mar 2 13:14:36 EST: %LINEPROTO-5-UPDOWN: Line protocol on Interface GigabitEthernet1/0/6, changed state to down
I was able to capture port going into error disable (through SPAN). Please see attached capture: https://app.box.com/s/2ow0tlutzxwk5odk0zuqhug1kgqlykbd
The IP address of the workstation that is on port gig1/0/6 is 18.104.22.168.
As far as I see there are many ARP requests for 22.214.171.124 from random workstations at 13:14:34 and that is causing port to go into err-disable.
I am working with a Cisco
Port configuration is standard for all access ports:
switchport access vlan 79 switchport mode access switchport voice vlan 3001 switchport port-security maximum 3 switchport port-security switchport port-security aging time 2 switchport port-security violation restrict ip arp inspection limit rate 20 srr-queue bandwidth share 1 30 35 5 queue-set 2 priority-queue out mls qos trust device cisco-phone mls qos trust cos spanning-tree portfast service-policy input AUTOQOS-SRND4-CISCOPHONE-POLICY ip dhcp snooping limit rate 20
I'm also including the arp inspection config (the dhcp-snooping config on vlan 79 is typical):
ip arp inspection vlan 79 ip arp inspection validate src-mac ip ip arp inspection log-buffer entries 1024 ip arp inspection log-buffer logs 1024 interval 10
I am wondering why would random workstations try to resolve ip address of workstation connected to the 1/0/6 in less than a second?