We have an issue on a Cisco A901-6CZ-F-A with high cpu caused by Arp requests coming on Vlan11 from our customer.
We enabled 'debug arp' to try and diagnose, below is a small snippet.
IP addresses and mac addresses have been changed for the purpose of this post.
Feb 99 20:44:51.107 GMT: IP ARP: rcvd rep src 10.2.1.200 0004.f2aa.aaaa, dst 10.2.255.253 Vlan11 Feb 99 20:44:51.131 GMT: IP ARP: creating incomplete entry for IP address: 10.2.5.133 interface Vlan11 Feb 99 20:44:51.131 GMT: IP ARP: sent req src 10.2.255.253 ecbd.1daa.aaaa, dst 10.2.5.133 0000.0000.0000 Vlan11
On Vlan11 there is an ip/mask of 10.2.5.133 255.255.0.0
From reading about proxy-arp, which is on by default, our router is replying to the arp requests with its own mac address ecbd.1daa.aaaa from Vlan11.
Why these request are coming to us is still a mystery, could be miss-configured default route on customer lan, wrong subnet mask, etc?
I thought the router could be stopped from responding to these requests with:
no ip proxy-arp
But with 'debug arp' we still see the router responding, so perhaps this is not proxy-arp?
I wanted to capture the traffic that was causing these requests, and tried to do so with the following capture:
monitor capture buffer BUFFER
monitor capture point ip process-switched PROC both
I don't see the ARP requests within my capture, i also don't see the ARP requests with:
monitor capture point ip cef CEF Vlan11 both
Have I miss understood proxy-arp? Is there a better method to identify the traffic?
