[c-nsp] ARP oddness

[Lee]

Unicast flooding?  You didn't say if the destination MAC address was
known on the switch or no..

Lee


On 8/19/11, Chuck Church <chuckchurch at gmail.com> wrote:
> Anyone,
>
>        Researching some issues at a remote site, seeing something I don't
> think should happen.  A packet capture on this remote server using wireshark
> and focusing in on ARP is seeing all the requests (as I'd expect), but I'm
> also seeing unicast replies that I shouldn't.  The MAC address table on the
> switch I'm attached to shows only the MAC of this remote server on that
> port.  There are no SPAN sessions on the switch either.  The destination
> addresses aren't multicast, they're true unicast.  Yet I'm seeing all these
> unicasts that aren't my mac address.  Is there some function built into a
> Cisco switch that broadcasts these to make them act like gratuitous ARPs, or
> am I really seeing something that shouldn't happen?  It's on a Sup2+ 4500,
> running 12.2(25)EWA10 (I know it's ancient, vendor owns it...)
>
> Thanks,
>
> Chuck
> _______________________________________________
> cisco-nsp mailing list  cisco-nsp at puck.nether.net
> https://puck.nether.net/mailman/listinfo/cisco-nsp
> archive at http://puck.nether.net/pipermail/cisco-nsp/
>