Catalyst C2960S %SW_DAI-4-INVALID_ARP: 1 Invalid ARPs

[David.Schmidt11]

Hello,

we have on one of our Costumer Switches (Catalyst C2960-S9  Version 12.2(58)SE2) a Problem regarding Invalid ARPs:

May 15 09:39:38.839 CEST: %SW_DAI-4-DHCP_SNOOPING_DENY: 1 Invalid ARPs (Req) on Gi1/0/12, vlan 10.

May 15 12:51:34.385 CEST: %SW_DAI-4-INVALID_ARP: 1 Invalid ARPs (Req) on Gi1/0/12, vlan 10.

We have Mutliple Entrys in the Log, and our Pings to the Client look like this:

!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!..............................!!!!!!!!!!
!!!!!!!!!!!!!!!!!!!!..............................!!!!!!!!!!!!!!!!!!!!
!!!!!!!!!!..............................!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
..............................!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!..........
....................!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!....................
...........!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!.............................
.!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!..............................!!!!!!!!!
!!!!!!!!!!!!!!!!!!!!!..............................!!!!!!!!!!!!!!!!!!!
!!!!!!!!!!!..............................!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
!...............................!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!........
......................!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!..................
............!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!............................
..!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!........................

Does someone knew which Cisco Bug this is (Found something in another Thread, but they didn't sayed which Bug ID it was).

[Spooster IT Services]

Hi David.Schmidt11,

These logs entries are indicating that ARP inspection droping the packet as the arp request is not matching the DHCP snooping binding table. Verify that "sh ip dhcp snooping binding" entry and ARP request must be matching.

[Hitesh Vinzoda]

someone is spoofing ARP on port 1/0/12, get the device checked for any infections connected on the port.

Thanks

Hitesh