1

I have a user getting error "No logon servers available" at login on a Windows machine.

Topology is this: R1--SW1--IP phone--PC1

I cannot ping PC1 neither from its gateway R1 nor from SW1 (access switch). ARP table is shown as INCOMPLETE:

SW1#sh ip arp 22.9.38.113
Protocol  Address          Age (min)  Hardware Addr   Type   Interface
Internet  22.9.38.113             0   Incomplete      ARPA

The MAC address of the PC is learned dynamically on by the SW1:

SW1#show mac address-table dynamic address ECA8.6B2F.9B63
Unicast Entries
 vlan   mac address     type        protocols               port
-------+---------------+--------+---------------------+--------------------
 107    eca8.6b2f.9b63   dynamic ip,ipx,assigned,other GigabitEthernet2/22   

SW1#sh int GigabitEthernet2/22 status

Port      Name               Status       Vlan       Duplex  Speed Type
Gi2/22    IP Phone to PC     connected    107        a-full  a-100 10/100/1000-TX

My understanding of Incomplete ARP table condition is this: by issuing ping command from SW1, ARP request was sent to the PC1 but PC1 for whatever reasons did not send ARP reply back to SW1, therefore SW1 lists MAC address as INCOMPLETE in ARP table.

My question is then this: why PC1 MAC address is listed in SW1 mac address table? If there are no ARP replies from PC1, how SW1 still learns its MAC address dynamically? Does it mean that SW1 is still receiving ARP packets from PC1? I tested connectivity after more than 5 minutes (MAC address age-out time), and still see MAC address as being learned dynamically but still no successful ping to PC1.

MAC address aging is set to default 300 seconds:

SW1#sh mac address-table aging-time vlan 107
Vlan    Aging Time      Configured Aging Time
----    ----------      ---------------------
Global Vlan Admin Age: 300
 107    300             300

Here is the config of the PC-facing interface on SW1:

SW1#sh run int GigabitEthernet2/22  
Building configuration...

Current configuration : 374 bytes
!
interface GigabitEthernet2/22
 description IP Phone to PC
 switchport access vlan 107
 switchport mode access
 switchport voice vlan 707
 no logging event link-status
 snmp trap mac-notification change added
 snmp trap mac-notification change removed
 no snmp trap link-status
 spanning-tree portfast
 spanning-tree bpduguard enable
 service-policy input QOS-MARKING
end
Improve this question
5
  • Don't confuse ARP (layer-3 to layer-2 address resolution) with MAC leaning by layer-2 switches, where the MAC address table gets built or changed by the source MAC address for every frame entering a switch.
    – Ron Maupin ♦
    Sep 29, 2018 at 15:01
  • so if a frame from a source actually does enter a switch, why switch ARP table does not list source's MAC address, but rather labels it as "Incomplete"?
    – kamokoba
    Sep 30, 2018 at 7:59
  • 1
    The switch doesn't use ARP to populate its MAC address table because the switch isn't looking at layer-3 addresses. Do not confuse a host. ARP table with a switch MAC address table. A switch MAC address table is to deliver frames to the correct destination interface. It uses the source MAC address from a frame to build the table, and the table consists of the source MAC address and the interface where the frame with it entered the switch.
    – Ron Maupin ♦
    Sep 30, 2018 at 15:02
  • Thanks. So, simply put, the Incomplete ARP means that L2 connectivity is OK, but L3 connectivity is not OK. In our NOC we have a canned answer for Incomplete ARP cases where we advise users to check the host's NIC because "it may be malfunctioning". Now I am beginning to doubt the validity of this advise, since the bad NIC would be a L1 problem so the connectivity at all the higher OSI layers would fail too
    – kamokoba
    Oct 1, 2018 at 18:06
  • 1
    Right. An incomplete ARP entry simply means that the requesting host did not (yet?) get an ARP reply for the queried host. That doesn't really have anything to do with a bad NIC. A managed switch may have an ARP table for the management "host" in the switch , but it plays no part in the layer-2 switching, it is only for the switch management that acts like a host on the LAN. Either the host with that IP address is offline, or there is some network configuration problem preventing the request from reaching the queried host, or a problem preventing the reply from reaching the querier.
    – Ron Maupin ♦
    Oct 1, 2018 at 18:12

3 Answers 3

Reset to default
1

Based on a similar experience documented at https://arstechnica.com/civis/viewtopic.php?t=233974 the OP had an incomplete ARP response and resolved it with a new patch cable - the existing was crimped.

I recommend replacing patch cables or look at the structured cabling plant.

A simple test would be to unplug the patch cable from the phone and plug it into the computer, assuming the phone is working. Then test without the phone inline.

Improve this answer
1

If the port association hasn't changed, is still correct, and the VLAN association is also correct then your problem isn't that of MAC aging.

Your problem is that the MAC layer (L2) doesn't work. ARP is broadcast throughout the L2 segment (broadcast domain). Either the ARP request doesn't reach the destination or the response doesn't reach the source. There may be a filter in between (check ACLs and similar) or a switch is malfunctioning.

If you've changed network settings it's also possible that the source thinks the destination is on its own subnet while it really isn't - the ARP request can't reach the destination.

Improve this answer
5
  • I know the problem is not with MAC aging - I am just interested why MAC address table on the switch still lists PC's MAC address as if it was learned dynamically, even though presumably there is no layer 2 connectivity between SW and PC
    – kamokoba
    Sep 29, 2018 at 7:24
  • The MAC is learned by receiving a frame on that port - any frame. So, if the link (somewhat) works at least unidirectionally, the MAC gets updated.
    – Zac67 ♦
    Sep 29, 2018 at 7:36
  • The phone uses LLDP (or CDP?) to negotiate it's voice VLAN 707 connection to the switch. The PC is on VLAN 107 and the phone passes this through, so the switch sees the PC as directly connected to the access port.
    – Dacid Salin
    Sep 29, 2018 at 7:55
  • LLDP doesn't negotiate, it's a send-only discovery protocol, likewise CDP. VLAN 107 is associated with untagged frames on SW1.
    – Zac67 ♦
    Sep 29, 2018 at 8:01
  • @Thomas H - If it's a Cisco phone and perhaps others, the port is spanned.that copies all traffic from a source port or source VLAN to a destination interface. In effect. this should appear to be an L2 connection...Right?
    – Dacid Salin
    Sep 30, 2018 at 5:27
1

The answers by Ron Maupin and other users helped me to understand why ARP table does not list the end host's MAC address even though that MAC address is being learned by the switch:

"An incomplete ARP entry simply means that the requesting host did not (yet?) get an ARP reply for the queried host. That doesn't really have anything to do with a bad NIC. A managed switch may have an ARP table for the management "host" in the switch , but it plays no part in the layer-2 switching, it is only for the switch management that acts like a host on the LAN. Either the host with that IP address is offline, or there is some network configuration problem preventing the request from reaching the queried host, or a problem preventing the reply from reaching the querier." - Ron Maupin

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.