[c-nsp] 6500 ARPing behaviour

[Whitlock, Ronnie]

Patrick,

Do you happen to have a route pointing to this SVI interface?  Like
x.x.x.x x.x.x.x vlan 10.  If so this will cause the behavior that you are seeing.


Ronnie


________________________________________
Date: Mon, 27 Jul 2009 18:27:16 +1000
From: PW <pwu828 at gmail.com>
To: cisco-nsp at puck.nether.net
Subject: [c-nsp] 6500 ARPing behaviour
Message-ID:
        <a7c61c610907270127n2de51383h2a16a51301c398aa at mail.gmail.com>
Content-Type: text/plain; charset=ISO-8859-1

Hi All,

Recently we are seeing some unusual behaviour with one of our 6500 switches,
where it is broadcasting ARPs for every IP address sequentially within the
subnet of one of the SVIs every now and then.

There are two streams of sequential broadcasts that I can see, with one
starts a few minutes later than the other. Not all IPs in the subnet can be
resolved as those IPs are not used.

I have captured the ARP traffic for an actual host within the subnet, and
apart from an ARP response from the host back to the 6500 switch, there is
really nothing else happening after that.

Any one have an idea of why the switch is behaving this way? I initially
thought some external hosts is trying to ping every address on the subnet,
but after I found out apart from the ARP traffic there's nothing else, I'm
not so sure.

Thanks in advance!

cheers,
Patrick