1

While checking the ARP table on my switches, I found many entries that shouldn't be there. Before going into further details, I would like to emphasize that I'm talking about the ARP table and not the CAM/mac-address table of the switch, as i have seen quite a few people use the two terms interchangeably .

So in my scenario, we have a large L2 network spanning across many switches. Some of the switches are managed through the dedicated management port (connected to the same management vlan) while some are managed through the the local vlan interface. There is no inter-vlan routing or such involved. AFAIK, the ARP table on these switches should ONLY contain the entries/mappings for those IPs that communicates with the management IP of the switch itself, for example, the NTP, syslog, monitoring servers etc. But in my case, I see multiple entries for other IPs in the network that should never need to access the switch or vice-versa.

What could be the reason for this sort of behavior?

  • I had a hard time understanding exactly what you were seeing, so I checked on one of my access stacks here. I see all the PCs that communicate with the switch stack in one way or another. My stack sees all the IP addresses on the management VLAN. Do you have an example of what you're seeing, or model of switch or anything? – Duffman Feb 5 '18 at 14:02
  • I observed this on some Dell F10 switches and on an extreme switch as well. I'm also talking about my management vlan here that is spanning across these switches. I see the management IPs of many other servers in our network in the ARP table apart from those of my NTP and syslog servers. I don't understand why the other IPs exist in the ARP table as there should be no communication between them and the switches. The MAC address of these should be present in the CAm table (which they are), but why in the ARP table as well? Please let me know if anything else needs to be clarified? – J.B Feb 5 '18 at 14:16
  • Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you could provide and accept your own answer. – Ron Maupin Apr 1 '18 at 20:29
4

Gratuitous ARP is a likely explanation.

From Wireshark wiki:

Gratuitous ARP

Gratuitous ARP could mean both gratuitous ARP request or gratuitous ARP reply. Gratuitous in this case means a request/reply that is not normally needed according to the ARP specification (RFC 826) but could be used in some cases. A gratuitous ARP request is an AddressResolutionProtocol request packet where the source and destination IP are both set to the IP of the machine issuing the packet and the destination MAC is the broadcast address ff:ff:ff:ff:ff:ff. Ordinarily, no reply packet will occur. A gratuitous ARP reply is a reply to which no request has been made.

Gratuitous ARPs are useful for four reasons:

  • They can help detect IP conflicts. When a machine receives an ARP request containing a source IP that matches its own, then it knows there is an IP conflict.

  • They assist in the updating of other machines' ARP tables. Clustering solutions utilize this when they move an IP from one NIC to another, or from one machine to another. Other machines maintain an ARP table that contains the MAC associated with an IP. When the cluster needs to move the IP to a different NIC, be it on the same machine or a different one, it reconfigures the NICs appropriately then broadcasts a gratuitous ARP reply to inform the neighboring machines about the change in MAC for the IP. Machines receiving the ARP packet then update their ARP tables with the new MAC.

  • They inform switches of the MAC address of the machine on a given switch port, so that the switch knows that it should transmit packets sent to that MAC address on that switch port.
  • Every time an IP interface or link goes up, the driver for that interface will typically send a gratuitous ARP to preload the ARP tables of all other local hosts. Thus, a gratuitous ARP will tell us that that host just has had a link up event, such as a link bounce, a machine just being rebooted or the user/sysadmin on that host just configuring the interface up. If we see multiple gratuitous ARPs from the same host frequently, it can be an indication of bad Ethernet hardware/cabling resulting in frequent link bounces.
| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.