topic arp reply as broadcast in Network Security

arp reply as broadcast

ksAlec — Thu, 14 Sep 2023 10:08:57 GMT

Why would an arp reply be sent as a broadcast? And out on an interfaces that didn't send the request?

I've disabled proxy arp and I can still see arp replies from our cisco

12:05:18.299985 5c:71:0d:xx:xx:xx > ff:ff:ff:ff:ff:ff, ethertype ARP (0x0806), length 60: Reply 10.x.x.x is-at 5c:71:0d:xx:xx:xx, length 46

balaji.bandi — Thu, 14 Sep 2023 10:21:12 GMT

You need to give more information what IP address its ARP ? same subnet of the interface IP or different segement.

ksAlec — Thu, 14 Sep 2023 10:39:29 GMT

The interface I see it on is a different segment from the address the arp reply is about.

The arp request didn't come in on that interface either.

But even if it die I'd expect a reply not to be a broadcast anyway.

MHM Cisco World — Thu, 14 Sep 2023 11:50:54 GMT

As you mention two cases here

One is proxy arp

Other is there is static route toward interface.

So disable proxy arp

Change static route to include next hop and egress interface