6

I am polling ARP tables from a Cisco Catalyst 2960 switch. The problem I encounter is that I have 3 ports into which I placed a server, a laptop and the cable from the switch. When I poll the ARP table I get details for only the switch and the server, but not for the laptop. The server and the switch have static IP`s whereas the laptop has a dynamic IP from DHCP. What could be the reason for this?

1
  • Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you can post and accept your own answer.
    – Ron Maupin
    Jan 4 at 22:02
6

Please ping the DHCP machine before polling. After the ping, tables will be populated. If you can't ping the DHCP laptop, then you know why you can't see it in the ARP table.

6

You probably want to be polling the CAM/MAC tables, that would have the MAC address of any devices send any traffic through the switch. ARP is L3 CAM/ARP is L2

2

There isn't a lot of detail to go on here, but I will make some guesses and try to provide the best answer I can. If you do provide more details, then I will edit my answer if anything changes.

The essence of your question is why the entry for the laptop isn't there, and simply the answer is that there has been no need for the switch to have added the entry to the ARP table. The switch will only add the entry to the ARP table if it needs to interact with a device at L3.

So, based on your description, I would presume that the 2960 is not the gateway device. Nor has the laptop connected to the management interface of the 2960 (ping, telnet, ssh, snmp, etc).

The server is probably the device making the SNMP requests, and therefore connecting to the management interface.

For the third device, you mention the "cable from the switch" but since you aren't (I hope) connecting the 2960 to itself, I would guess this is the built in switch of some sort of gateway device, and this is the other device you have listed in the ARP table.

If you ping the 2960 with the laptop, you should find that the ARP table will populate an entry for it (until it times out).

2

ARP tables are populated when the machine sends any traffic to the network (DHCP or any other). The switch receives the packets generated by the machine and grabs the mac address of the machine and puts in ARP table with the information of the port it came from.

So, if you can't see the ARP entry of the laptop, it means that the laptop did not exchange any packets with switch.

A note, there are two commands for arp: sh arp and sh ip arp.

sh arp: will show you arp entries for non-IP protocols like appletalk, ipx etc.

sh ip arp: will show you only about IP protocol.
3
  • 1
    A switchwill populate an arp table if it sees an arp NOT if it sees traffic, lets say the arp timeout of the switch is shorter than the arp timeouts of the hosts, the arp entries will disappear.
    – fredpbaker
    Sep 14 '13 at 1:13
  • true but ARP is traffic.
    – AdnanG
    Sep 14 '13 at 10:44
  • I would suggest that " any traffic to the network " not the same as "any ARP traffic to the network ". A long running FTP will not keep the arp table populated in the switch if the routers and hosts ARP timers are longer than that of the swtich
    – fredpbaker
    Sep 14 '13 at 18:30

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.