[c-nsp] 6500 ARPing behaviour

[PW]

Thank you all,

I have checked the captured traffic (not just ARP traffic) on the host, but
nothing relevant except the ARP response...

I will proceed to check the cache flows the next time it happens, but last
time I checked there's nothing really stands out, but then I didn't have all
the interfaces cache flows turned on...

And yes, there are some hosts that have a default route to that SVI. Local
proxy-arp is off by default I believe and I have not change that...

The issue only happens once a day for the last few days at random time each
day. The configuration worked fine before, and there were no major changes
in the infrastructure configuration of the switch except for adding a few
vlans and IPs, so the issue might be originated from those networks...

Now just need to wait for the next iteration of the issue...

Thanks again!

Patrick

On Tue, Jul 28, 2009 at 3:10 AM, Whitlock, Ronnie <UCS_RLW at shsu.edu> wrote:

> Patrick,
>
> Do you happen to have a route pointing to this SVI interface?  Like
> x.x.x.x x.x.x.x vlan 10.  If so this will cause the behavior that you are
> seeing.
>
>
> Ronnie
>
>
> ________________________________________
> Date: Mon, 27 Jul 2009 18:27:16 +1000
> From: PW <pwu828 at gmail.com>
> To: cisco-nsp at puck.nether.net
> Subject: [c-nsp] 6500 ARPing behaviour
> Message-ID:
>        <a7c61c610907270127n2de51383h2a16a51301c398aa at mail.gmail.com>
> Content-Type: text/plain; charset=ISO-8859-1
>
> Hi All,
>
> Recently we are seeing some unusual behaviour with one of our 6500
> switches,
> where it is broadcasting ARPs for every IP address sequentially within the
> subnet of one of the SVIs every now and then.
>
> There are two streams of sequential broadcasts that I can see, with one
> starts a few minutes later than the other. Not all IPs in the subnet can be
> resolved as those IPs are not used.
>
> I have captured the ARP traffic for an actual host within the subnet, and
> apart from an ARP response from the host back to the 6500 switch, there is
> really nothing else happening after that.
>
> Any one have an idea of why the switch is behaving this way? I initially
> thought some external hosts is trying to ping every address on the subnet,
> but after I found out apart from the ARP traffic there's nothing else, I'm
> not so sure.
>
>  Thanks in advance!
>
> cheers,
> Patrick
> _______________________________________________
> cisco-nsp mailing list  cisco-nsp at puck.nether.net
> https://puck.nether.net/mailman/listinfo/cisco-nsp
> archive at http://puck.nether.net/pipermail/cisco-nsp/
>