IP is in ARP but the MAC is not in mac address-table

[Stephen Carville]

I am trying to find a couple of machines on a remote 3850 stack.  My normal procedure for this is to:

1. ping the machine from somewhere.

2. show arp <IP address>

3. show mac address-table address <MAC address from above>

For some reason this is not working for a couple of new machines.  For example:

# show arp 10.200.100.110                      

Protocol  Address          Age (min)  Hardware Addr   Type   Interface
Internet  10.200.100.110          0   64f6.9d7a.0686  ARPA   Vlan500

# show mac address-table address 64f6.9d7a.0686

          Mac Address Table
-------------------------------------------

Vlan    Mac Address       Type        Ports
----    -----------       --------    -----

Anyone have any idea why this is happening and how I can fix it?

[Cisco Freak]

Hi Stephen,

Are you able to ping the IP address: 10.200.100.110? 

CF

[Stephen Carville]

Yes.  I can ping it fine.  I can even log onto it using DameWare.

[Jon Marshall]

It sounds like it may just be a bug because the procedure you are using has always worked for me.

Have a read of this thread which is quite a while ago but the same symptoms you are seeing -

https://supportforums.cisco.com/discussion/12328826/3850-switch-stack-mac-address-issues

you may be running a different software version but perhaps try a different one.

Note I very rarely recommend upgrading as a solution, and it may not make a difference, but I can't see what else could be causing it to be honest.

Jon

[Stephen Carville]

The switches are at version 03.02.03.SE so a bug is certainly possible. Also this command (I just learned) works correctly:

# show ip device tracking all

[mrityunjay singh]

Hi Stephen,

Have you tried to flush the individual mac entry on port?

You can also try to shut/unshut the logical link if it is associated with single service, sometimes port or mac table may get hang( behave unsual).

If this not worked this could be due to bug.

Thanks,

[Cisco Freak]

Strange!

Can you see the mac address listed with this command 'show mac-address-table vlan 500' ?

[paul driver]

Hello

I am trying to find a couple of machines on a remote 3850 stack

For some reason this is not working for a couple of new machines.

64f6.9d

The U/L of that mac address suggests its locally administered address and its OUI relates to a Cisco device.

So when you state machines are theses end hosts or another switch/router.and when you lookup the arp of these machines, Is from this remote stack itself?

Try an arp lookup from the L3 switch or router for this network and see if the results differ?

res

Paul

[Stephen Carville]

The two machines in this case are both Cisco model UCSC-C220-M4S and have Cisco ethernet cards.

[neonova.net]

I have this same issue running 17.05.01. I've got a gateway VLAN interface that has ARP for a device but doesn't have a mac address in the table for the same device. So what I did was set the ARP timeout on the interface to 15 minutes and the MAC aging on the switch to 20 minutes. The issue I was running into was I couldn't even ping the device even though I had a ARP entry because it wasn't in the mac table. If I cleared ARP then I could ping it because it would do a new ARP and force the device to reply and repopulate the mac table, 5 minutes later though it would drop out of the table because of the default mac aging time, and I couldn't ping it again.

I even went as far as just setting a static MAC address, this device shouldn't ever show up on another port.

mac address-table static 38f8.f6b5.3f19 vlan 399 interface Port-channel5

[Cristian Matei]

Hi,

   Playing with ARP/MAC timers for testing, all good; however for production networks, you shouldn't be changing these values to try and fix such scenarios, but only if you have a specific technical requirement. So best option is to look for stable recommend IOS version and see if it fixes the issue.

Best,

Cristian.