SH ip arp incomplete issue

[hakeem123]

When you do a sh int arp, you see the layer 3 IP address. You also see an "incomplete" next to the IP address, instead of the layer 2 MAC address. What incomplete mean?? How to resolve this issue??    

sh ip arp | include 192.168.41.203

Internet 192.168.41.203        0     Incomplete              ARPA    

Thanks

[Seb Rupik]

Hi there,

It simply means no device has sent an ARP reply for that IP address.

If you ran an IP scan on a subnet, any device listening would create an incomplete ARP cache entry for each IP which didn't respond.

Entries like these will be aged out so there is not much to worry about.

cheers,

Seb.

[luis_cordova]

Hi @hakeem123 ,

The primary cause of a  addr incomplete against a specific ip address is that the connected device is not responding. 

The incomplete  indicates that the switch has sent an arp to the device and did not receive a reply.

You can check the device along with the physical connectivity such as cabling and/or try moving the connection to another switch port.

Regards

[balaji.bandi]

simple is the device not connected, or disconnected from network.

check device connected port shows up or down ?

[hakeem123]

its connected..port is up.

[balaji.bandi]

what is the device that is connected and up, some device will not show arp entry until you ping them ?

some medical device have not show, i have seen this in medical world.

[hakeem123]

ITS FIRE ALARM PANEL..

[balaji.bandi]

yes fire alarm, door access control, some device dont show ARP in the switch, i have come across some.

but if the device have IP they can able to access from the respected device application.

No idea why ? vendor could not answer my questions.

[Richard Burts]

If the arp entry indicates incomplete then it means that you sent an arp request and the device did not send a response. There are several things you can do to check on this.

1) what device is doing the arp and shows incomplete?

2) if the device is a layer 2 switch then what is the IP of its management interface? If it is a layer 3 switch or a router then post the output of show ip interface brief. This will allow to identify the interface and address that is sending the arp request.

3) what device is the fire alarm panel connected to?

4) what is the topology between the device generating the arp request and the device where the panel is connected?

5) can you verify the IP address of the panel and can you get the mac address of the panel? Is the IP assigned to the panel the address that you arp for?

6) assuming that the panel is connected to a switch can you check the mac address table of the switch and verify that the mac address of the panel does show up on the port that you believe it is connected to.

7) show output of show interface status of switch where panel is connected. Check the interface the panel is connected to. Does that interface show as connected/up? Is that interface in the vlan that you expect it to be? What is the IP subnet associated with that vlan. Do both the IP generating the arp request and the IP of the panel belong in that subnet?

HTH

Rick

[Anders Ballegaard]

It's just your routers way of saying that it sent an ARP request and have not received an answer.

If you see 1 or 2 of these i would't worry about it in most cases. But if you start seeing a lot of incomplete entries it could be a sign someone is scanning your network.