[c-nsp] 6500 ARPing behaviour

[Randy McAnally]

Sounds like maybe a line card resetting itself.  Enable as much logging as
possible and examine them.

--
Randy
\\\\\

---------- Original Message -----------
From: PW <pwu828 at gmail.com>
To: "Whitlock, Ronnie" <UCS_RLW at shsu.edu>
Cc: "cisco-nsp at puck.nether.net" <cisco-nsp at puck.nether.net>
Sent: Tue, 28 Jul 2009 10:52:37 +1000
Subject: Re: [c-nsp] 6500 ARPing behaviour

> Thank you all,
> 
> I have checked the captured traffic (not just ARP traffic) on the 
> host, but nothing relevant except the ARP response...
> 
> I will proceed to check the cache flows the next time it happens,
>  but last time I checked there's nothing really stands out, but then 
> I didn't have all the interfaces cache flows turned on...
> 
> And yes, there are some hosts that have a default route to that SVI. 
> Local proxy-arp is off by default I believe and I have not change that...
> 
> The issue only happens once a day for the last few days at random 
> time each day. The configuration worked fine before, and there were 
> no major changes in the infrastructure configuration of the switch 
> except for adding a few vlans and IPs, so the issue might be 
> originated from those networks...
> 
> Now just need to wait for the next iteration of the issue...
> 
> Thanks again!
> 
> Patrick
> 
> On Tue, Jul 28, 2009 at 3:10 AM, Whitlock, Ronnie <UCS_RLW at shsu.edu> 
> wrote:
> 
> > Patrick,
> >
> > Do you happen to have a route pointing to this SVI interface?  Like
> > x.x.x.x x.x.x.x vlan 10.  If so this will cause the behavior that you are
> > seeing.
> >
> >
> > Ronnie
> >
> >
> > ________________________________________
> > Date: Mon, 27 Jul 2009 18:27:16 +1000
> > From: PW <pwu828 at gmail.com>
> > To: cisco-nsp at puck.nether.net
> > Subject: [c-nsp] 6500 ARPing behaviour
> > Message-ID:
> >        <a7c61c610907270127n2de51383h2a16a51301c398aa at mail.gmail.com>
> > Content-Type: text/plain; charset=ISO-8859-1
> >
> > Hi All,
> >
> > Recently we are seeing some unusual behaviour with one of our 6500
> > switches,
> > where it is broadcasting ARPs for every IP address sequentially within the
> > subnet of one of the SVIs every now and then.
> >
> > There are two streams of sequential broadcasts that I can see, with one
> > starts a few minutes later than the other. Not all IPs in the subnet can be
> > resolved as those IPs are not used.
> >
> > I have captured the ARP traffic for an actual host within the subnet, and
> > apart from an ARP response from the host back to the 6500 switch, there is
> > really nothing else happening after that.
> >
> > Any one have an idea of why the switch is behaving this way? I initially
> > thought some external hosts is trying to ping every address on the subnet,
> > but after I found out apart from the ARP traffic there's nothing else, I'm
> > not so sure.
> >
> >  Thanks in advance!
> >
> > cheers,
> > Patrick
> > _______________________________________________
> > cisco-nsp mailing list  cisco-nsp at puck.nether.net
> > https://puck.nether.net/mailman/listinfo/cisco-nsp
> > archive at http://puck.nether.net/pipermail/cisco-nsp/
> >
> _______________________________________________
> cisco-nsp mailing list  cisco-nsp at puck.nether.net
> https://puck.nether.net/mailman/listinfo/cisco-nsp
> archive at http://puck.nether.net/pipermail/cisco-nsp/
------- End of Original Message -------