[c-nsp] ARP oddness

Chuck Church chuckchurch at gmail.com
Fri Aug 19 16:24:28 EDT 2011


Anyone,

       Researching some issues at a remote site, seeing something I don't
think should happen.  A packet capture on this remote server using wireshark
and focusing in on ARP is seeing all the requests (as I'd expect), but I'm
also seeing unicast replies that I shouldn't.  The MAC address table on the
switch I'm attached to shows only the MAC of this remote server on that
port.  There are no SPAN sessions on the switch either.  The destination
addresses aren't multicast, they're true unicast.  Yet I'm seeing all these
unicasts that aren't my mac address.  Is there some function built into a
Cisco switch that broadcasts these to make them act like gratuitous ARPs, or
am I really seeing something that shouldn't happen?  It's on a Sup2+ 4500,
running 12.2(25)EWA10 (I know it's ancient, vendor owns it...)

Thanks,

Chuck


More information about the cisco-nsp mailing list