6

I am polling ARP tables from a Cisco Catalyst 2960 switch. The problem I encounter is that I have 3 ports into which I placed a server, a laptop and the cable from the switch. When I poll the ARP table I get details for only the switch and the server, but not for the laptop. The server and the switch have static IP`s whereas the laptop has a dynamic IP from DHCP. What could be the reason for this?

Improve this question
1
  • Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you can post and accept your own answer.
    – Ron Maupin ♦
    Commented Jan 4, 2021 at 22:02

4 Answers 4

Reset to default
6

Please ping the DHCP machine before polling. After the ping, tables will be populated. If you can't ping the DHCP laptop, then you know why you can't see it in the ARP table.

Improve this answer
6

You probably want to be polling the CAM/MAC tables, that would have the MAC address of any devices send any traffic through the switch. ARP is L3 CAM/ARP is L2

Improve this answer
2

There isn't a lot of detail to go on here, but I will make some guesses and try to provide the best answer I can. If you do provide more details, then I will edit my answer if anything changes.

The essence of your question is why the entry for the laptop isn't there, and simply the answer is that there has been no need for the switch to have added the entry to the ARP table. The switch will only add the entry to the ARP table if it needs to interact with a device at L3.

So, based on your description, I would presume that the 2960 is not the gateway device. Nor has the laptop connected to the management interface of the 2960 (ping, telnet, ssh, snmp, etc).

The server is probably the device making the SNMP requests, and therefore connecting to the management interface.

For the third device, you mention the "cable from the switch" but since you aren't (I hope) connecting the 2960 to itself, I would guess this is the built in switch of some sort of gateway device, and this is the other device you have listed in the ARP table.

If you ping the 2960 with the laptop, you should find that the ARP table will populate an entry for it (until it times out).

Improve this answer
2

ARP tables are populated when the machine sends any traffic to the network (DHCP or any other). The switch receives the packets generated by the machine and grabs the mac address of the machine and puts in ARP table with the information of the port it came from.

So, if you can't see the ARP entry of the laptop, it means that the laptop did not exchange any packets with switch.

A note, there are two commands for arp: sh arp and sh ip arp. 

sh arp: will show you arp entries for non-IP protocols like appletalk, ipx etc.

sh ip arp: will show you only about IP protocol.
Improve this answer
3
  • 1
    A switchwill populate an arp table if it sees an arp NOT if it sees traffic, lets say the arp timeout of the switch is shorter than the arp timeouts of the hosts, the arp entries will disappear.
    – fredpbaker
    Commented Sep 14, 2013 at 1:13
  • true but ARP is traffic.
    – AdnanG
    Commented Sep 14, 2013 at 10:44
  • I would suggest that " any traffic to the network " not the same as "any ARP traffic to the network ". A long running FTP will not keep the arp table populated in the switch if the routers and hosts ARP timers are longer than that of the swtich
    – fredpbaker
    Commented Sep 14, 2013 at 18:30

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.