[j-nsp] Weird ARP issue

[Chris Cappuccio]

Luca Salvatore [Luca at ninefold.com] wrote:
> I Haven???t touched any ARP config, it???s just the defaults.
> 
> The plot thickens:
> 
> I did some port-mirroring, when I send traffic on port 80 to the VM the switch will generate an Arp request.
> Same if I do a ping, I see an ARP request.
> 
> However for SSH traffic, the switch never generates an ARP request so the traffic never gets to the end host.
> 

The ARP request is initiated by the end host, not the switch. The switch
passes it. The switch can't tell if the ARP request is initiated by
the SSH, PING, or any other request. Of course, the ping generates an
ARP request, then the host routing table no longer needs to do a second
ARP request for the SSH session, which would explain what you see (if
you aren't deleting the arp table entry on the end host between
tests)