Multiple odd entries in ARP table of switch

Question

While checking the ARP table on my switches, I found many entries that shouldn't be there. Before going into further details, I would like to emphasize that I'm talking about the ARP table and not the CAM/mac-address table of the switch, as i have seen quite a few people use the two terms interchangeably .

So in my scenario, we have a large L2 network spanning across many switches. Some of the switches are managed through the dedicated management port (connected to the same management vlan) while some are managed through the the local vlan interface. There is no inter-vlan routing or such involved. AFAIK, the ARP table on these switches should ONLY contain the entries/mappings for those IPs that communicates with the management IP of the switch itself, for example, the NTP, syslog, monitoring servers etc. But in my case, I see multiple entries for other IPs in the network that should never need to access the switch or vice-versa.

What could be the reason for this sort of behavior?

Answer 1

Gratuitous ARP is a likely explanation.

From Wireshark wiki:

Gratuitous ARP

Gratuitous ARP could mean both gratuitous ARP request or gratuitous ARP reply. Gratuitous in this case means a request/reply that is not normally needed according to the ARP specification (RFC 826) but could be used in some cases. A gratuitous ARP request is an AddressResolutionProtocol request packet where the source and destination IP are both set to the IP of the machine issuing the packet and the destination MAC is the broadcast address ff:ff:ff:ff:ff:ff. Ordinarily, no reply packet will occur. A gratuitous ARP reply is a reply to which no request has been made.

Gratuitous ARPs are useful for four reasons:

• They can help detect IP conflicts. When a machine receives an ARP request containing a source IP that matches its own, then it knows there is an IP conflict.

• They assist in the updating of other machines' ARP tables. Clustering solutions utilize this when they move an IP from one NIC to another, or from one machine to another. Other machines maintain an ARP table that contains the MAC associated with an IP. When the cluster needs to move the IP to a different NIC, be it on the same machine or a different one, it reconfigures the NICs appropriately then broadcasts a gratuitous ARP reply to inform the neighboring machines about the change in MAC for the IP. Machines receiving the ARP packet then update their ARP tables with the new MAC.

• They inform switches of the MAC address of the machine on a given switch port, so that the switch knows that it should transmit packets sent to that MAC address on that switch port.
• Every time an IP interface or link goes up, the driver for that interface will typically send a gratuitous ARP to preload the ARP tables of all other local hosts. Thus, a gratuitous ARP will tell us that that host just has had a link up event, such as a link bounce, a machine just being rebooted or the user/sysadmin on that host just configuring the interface up. If we see multiple gratuitous ARPs from the same host frequently, it can be an indication of bad Ethernet hardware/cabling resulting in frequent link bounces.