[c-nsp] ARP oddness

[Chuck Church]

I'll have to go back and double-check.  Since the ARP was a reply, I was
assuming the original request would have populated the L2 table correctly.
The logs didn't indicate any weird flapping.  But I'll double-check the
flooding.  It was lots of random destination addresses, none of them common
to the server I was running wireshark on.  I'll check it out again to be
sure though.

Thanks,

Chuck

-----Original Message-----
From: Lee [mailto:ler762 at gmail.com] 
Sent: Friday, August 19, 2011 11:05 PM
To: Chuck Church
Cc: NSP - Cisco
Subject: Re: [c-nsp] ARP oddness

Unicast flooding?  You didn't say if the destination MAC address was
known on the switch or no..

Lee


On 8/19/11, Chuck Church <chuckchurch at gmail.com> wrote:
> Anyone,
>
>        Researching some issues at a remote site, seeing something I don't
> think should happen.  A packet capture on this remote server using
wireshark
> and focusing in on ARP is seeing all the requests (as I'd expect), but I'm
> also seeing unicast replies that I shouldn't.  The MAC address table on
the
> switch I'm attached to shows only the MAC of this remote server on that
> port.  There are no SPAN sessions on the switch either.  The destination
> addresses aren't multicast, they're true unicast.  Yet I'm seeing all
these
> unicasts that aren't my mac address.  Is there some function built into a
> Cisco switch that broadcasts these to make them act like gratuitous ARPs,
or
> am I really seeing something that shouldn't happen?  It's on a Sup2+ 4500,
> running 12.2(25)EWA10 (I know it's ancient, vendor owns it...)
>
> Thanks,
>
> Chuck
> _______________________________________________
> cisco-nsp mailing list  cisco-nsp at puck.nether.net
> https://puck.nether.net/mailman/listinfo/cisco-nsp
> archive at http://puck.nether.net/pipermail/cisco-nsp/
>