1

We have a Netscreen router as the default gateway. I have a windows 7 machine in the network. I deleted the ARP cache on this windows machine using the command "arp -d". As soon as I did that, there was an ARP request from my windows 7 machine and I see that there are two responses from the GW (packet #1168 and 1170 in the below table).

1167 6.585819       Vmware_a9:70:dc       Broadcast             ARP      42     Who has 10.218.16.1? Tell 10.218.22.221
1168 6.588741       Netscreen_ff:50:01    Vmware_a9:70:dc       ARP      60     10.218.16.1 is at 06:22:bc:ff:50:01   
1170 6.590643       Netscreen_ff:50:01    Vmware_a9:70:dc       ARP      60     10.218.16.1 is at 06:22:bc:ff:50:01

I tried out a different machine in a different network and found that the router responded with only 1 response per request (this router seems to be a Cisco router)

2698 15:58:09.094908000 Vmware_85:6c:cf       Broadcast             ARP      42     Who has 10.211.32.1?  Tell 10.211.34.212   
2699 15:58:09.096329000 Cisco_e0:3f:01        Vmware_85:6c:cf       ARP      60     10.211.32.1 is at 00:00:0c:9f:f0:20

In both the cases, the ARP cache immediately had an entry for the default gateway.

What I cannot understand, is why the default gw is sending out two responses for one request?

Any pointers will be greatly appreciated.

  • 4
    could be a cluster of 2 machines with a virtual mac address. Each node of the cluster will respond. – JFL Mar 29 '16 at 13:27

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.