[c-nsp] [Forum] show arp hardware type INCOMPLETE

[Raymond Macharia]

Hi Luis,
The only way to find out is to follow Matthew's Suggestion, you need to
unplug each computer one at a time until you identfy the source of the arp
with the said IP subnet.
I had a similar problem some months back and that is way I managed to solve
the problem. It looks more like a worm to me

Raymond

On 1/6/06, Matthew Crocker <matthew at crocker.com> wrote:
>
>
> The IP addresses are in your routers ARP table because your router
> thinks the IPs are local.  Are you sure you don't have that network
> configured in your router someplace?   They are incomplete because
> your router cannot find the MAC Address of the machine with the IP
> address.   Your router cannot find the MAC Address because the
> machines don't exist.  You need to do 2 things,  1)  find out why
> your router thinks the 10.30/16 network is local and 2) why your
> router is getting packets destined for that network.   Next time it
> happens try unplugging one machine at a time until the problem goes
> away.  I suspect a virus/trojan/worm on your network somewhere.
>
> -Matt
>
> On Jan 6, 2006, at 5:58 AM, Luis Augusto Tiani da Silva *Luist* wrote:
>
> > I didn't make myself clear..... We have a little and simple
> > network, with a
> > server (NT) and some workstations. There no face with internet. Those
> > address in the arp table of our router doesn't exist in our
> > network, there
> > is no workstation configured with those addresses. I've been seing
> > some docs
> > in the internet and I thought it might be a worm, CODE RED, but we
> > don't
> > have IIS in this network, and when those IP's start to appear in
> > the arp
> > table of the router, the most workstations, even the server, get
> > the network
> > connection lost and get it back, and get lost.... until we restart the
> > machines or unplug and plug the cables from hub's/switches....
> >
> > better now? Have you ever seen this?
> > Tks!
> >
> > -----Original Message-----
> > From: Wojtek Zlobicki [mailto:wojtek.zlobicki at gmail.com]
> > Sent: quinta-feira, 5 de janeiro de 2006 23:01
> > To: Luis Augusto Tiani da Silva *Luist*
> > Cc: cisco-nsp at puck.nether.net
> > Subject: Re: [c-nsp] [Forum] show arp hardware type INCOMPLETE
> >
> >
> > Where are these servers plugged into.  ARP is incomplete because
> > the servers
> > are unreachable. There is nothing wrong with seeing incomplete arp,
> > you need
> > to trace where the end devices plug into.
> >
> >
> > On 1/5/06, Luis Augusto Tiani da Silva *Luist* <luist at riachuelo.com.br
> > <mailto:luist at riachuelo.com.br> > wrote:
> >
> > Hi all,
> >
> > All of our box at that specific lan get the network connection lost
> > and we
> > get a lot of entries in the arp table in the routers, just like you
> > posted
> > at that forum.... Soes anyone know's a solution for this problem?
> >
> > Thanks in advance.
> >
> > Luis Tiani
> >
> > P.S.: We've got this arp table:
> >
> > Protocol  Address          Age (min)  Hardware Addr   Type   Interface
> > Internet  10.30.0.40 <http://10.30.0.40>               0   Incomplete
> > ARPA
> > Internet  10.30.1.40 <http://10.30.1.40>               0   Incomplete
> > ARPA
> > Internet  10.30.0.41 <http://10.30.0.41>               0   Incomplete
> > ARPA
> > Internet    <http://10.30.1.43> 10.30.1.43              0   Incomplete
> > ARPA
> > Internet  10.30.0.42 <http://10.30.0.42>               0   Incomplete
> > ARPA
> > Internet  10.30.1.42 <http://10.30.1.42>               0   Incomplete
> > ARPA
> > Internet  10.30.0.43 <http://10.30.0.43>               0   Incomplete
> > ARPA
> > Internet  10.30.1.45 <http://10.30.1.45>               0   Incomplete
> > ARPA
> > Internet    <http://10.30.0.44> 10.30.0.44              0   Incomplete
> > ARPA
> > Internet  10.30.1.44 <http://10.30.1.44>               0   Incomplete
> > ARPA
> > Internet  10.30.0.45 <http://10.30.0.45>               0   Incomplete
> > ARPA
> > Internet  10.30.1.47 <http://10.30.1.47>               0   Incomplete
> > ARPA
> > Internet  10.30.0.46 <http://10.30.0.46>               0   Incomplete
> > ARPA
> > Internet    <http://10.30.1.46> 10.30.1.46              0   Incomplete
> > ARPA
> > Internet  10.30.0.47 <http://10.30.0.47>               0   Incomplete
> > ARPA
> > Internet  10.30.1.33 <http://10.30.1.33>               0   Incomplete
> > ARPA
> > Internet  10.30.0.32 <http://10.30.0.32>               0   Incomplete
> > ARPA
> > Internet  10.30.1.32 <http://10.30.1.32>               0   Incomplete
> > ARPA
> > Internet    <http://10.30.0.33> 10.30.0.33              0   Incomplete
> > ARPA
> > Internet  10.30.1.35 <http://10.30.1.35>               0   Incomplete
> > ARPA
> >
> > _______________________________________________
> > cisco-nsp mailing list   cisco-nsp at puck.nether.net
> > <mailto:cisco-nsp at puck.nether.net>
> > https://puck.nether.net/mailman/listinfo/cisco-nsp
> > <https://puck.nether.net/mailman/listinfo/cisco-nsp>
> > archive at http://puck.nether.net/pipermail/cisco-nsp/
> > <http://puck.nether.net/pipermail/cisco-nsp/>
> >
> >
> >
> >
> >
> > --
> > ----------------------------------------
> > wojtek.zlobicki at gmail.com <mailto:wojtek.zlobicki at gmail.com>
> >
> > _______________________________________________
> > cisco-nsp mailing list  cisco-nsp at puck.nether.net
> > https://puck.nether.net/mailman/listinfo/cisco-nsp
> > archive at http://puck.nether.net/pipermail/cisco-nsp/
>
> --
> Matthew S. Crocker
> Vice President
> Crocker Communications, Inc.
> Internet Division
> PO BOX 710
> Greenfield, MA 01302-0710
> http://www.crocker.com
>
> _______________________________________________
> cisco-nsp mailing list  cisco-nsp at puck.nether.net
> https://puck.nether.net/mailman/listinfo/cisco-nsp
> archive at http://puck.nether.net/pipermail/cisco-nsp/
>



--
Raymond Macharia