2

We've got two HP2920-48G PoE switches connected together via a simple 1Gb cable (SW2:48 -> SW1:01), and then SW1:A1 fiber-channel to a central switch (SW9:A1).

All switches are untagged in the DEFAULT_VLAN (one /19 broadcast domain).

We have PoE Cisco phones plugged into SW2 and basically PCs/Macs plugged into SW1.

When we do a clear arp in SW2, it seems to be able to ping everything in the network (as expected), but moments later it loses its ability to connect to certain IP addresses within the broadcast domain, including SW1 which is the switch it directly connects to. However, all the phones still work, and anything running ethernet still switches correctly. Its only the access to and from SW2:DEFAULT_VLAN address that seems to go bad.

We are not network engineers, but we know our way around switches a bit. What would be causing bad ARP entries, or why would clear arp fix it momentarily, but only for the moment?

3
  • 1
    2920 doesn't do "fiber channel"; it's an ethernet switch. I assume you mean "fiber optic cable"?
    – Ricky
    Jun 23, 2015 at 20:42
  • Just curious, do you have any VLAN's configured? Voice, etc? Feb 19, 2016 at 17:08
  • Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you could provide and accept your own answer.
    – Ron Maupin
    Aug 11, 2017 at 17:36

2 Answers 2

2

ARP is a layer-3 ("IP") technology. Under normal conditions an ethernet switch should have nothing at all in it's arp cache, because 100% of what it does is layer-2 ("ethernet") switching. The only arp entries would be for management access (eg. the MAC of your machine would be known to it while you have a connection to it.)

If the UI is going away but it's otherwise still passing traffic, that sounds like something is attacking the switch, or otherwise overloading it (eg. thinking it's a router, or other server.)


hp-2810-1# show arp

 IP ARP table

  IP Address      MAC Address       Type    Port
  --------------- ----------------- ------- ----
  192.168.0.1     000423-c6a4ec     Dynamic Trk1 (the router)

vs.

hp-2810-1# show mac-address 

 Status and Counters - Port Address Table

  MAC Address   Located on Port
  ------------- ---------------
  000423-c6a4ec Trk1           
  000423-c6a4ed Trk1           
  .... (many pages, in fact)

Despite the volume of broadcast traffic through the switch, very little (none) is in the management vlan (10 in my case.)

hp-2810-1# show cpu

4 percent busy, from 178 sec ago
1 sec ave: 3 percent busy
5 sec ave: 2 percent busy
1 min ave: 5 percent busy
4
  • We have no special configuration in either switch. SW2 used to have A1 and A2 in an LACP configuration, but no more and our utilization in SW1 is less 0.10% continuously through this switch. We lose direct ssh, telnet, snmp connections, I cannot reach the IP address configured on the default vlan even from a switch connected directly to it which would indicate... what exactly? Any idea why would 'clear arp' fixes this temporarily?
    – Remi
    Jun 24, 2015 at 12:32
  • arp table overflow? due to the size of the layer-3 network, broadcast traffic could be flooding the cache. I assume you're accessing it from the console when this happens (how else would you clear arp), look at the arp table when it "fails". (beyond that, engage hp support; they'll want a show tech, which is far more than I want to see.)
    – Ricky
    Jun 24, 2015 at 21:52
  • "Ricky Beam" is incorrect. I couldn't reply to him because I have a new account. ARP is technically both layer TWO and THREE technology, NOT just layer three. ARP is encapsulated in layer 2 protocols. Remember, a switch is a multiport bridge that performs filtering based on MAC ADDRESSES! I would recommend following the advice of poster "Karl Billington", check the ARP cache. I cannot provide the answer to your actual question regarding these connectivity issues, although I can guarantee you as a networking student that switches are layer TWO devices. - Elija CompTia A+ Certified
    – Elija
    Sep 2, 2017 at 1:03
  • 1
    @Elija, ARP is a L3 technology that enables devices to map a L3 address to a L2 address. It operates at L3, but does include L2 information. However it is not a L2 technology. Nor does being encapsulated in layer 2 protocols make it a L2 technology. By that definition, that would make all network traffic a L2 technology.
    – YLearn
    Sep 2, 2017 at 3:28
0

There may be duplicate IP addresses in the network. When you clear the arp cache, note down the MAC address in the ARP cache on SW2 which matches SW1's IP address, check you can SSH to SW1. When it stops working, check the ARP cache again and see if the MAC address for SW1's IP address has changed, if it has then there are duplicate IP addresses in the network.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.