%ARP-3-INVAL_HDR

Muhammed AKYUZ · ‎06-11-2012

Hi,

we are getting these logs on Nexus 7010. How can we find the device that causing this problem?

2012 Jun 1 17:26:09

%ARP-3-INVAL_HDR

: arp [5793] Found incorrect hardware/protocol

type in ARP header: 6/2048

2012 Jun 1 17:28:00 last message repeated 2 times

2012 Jun 1 17:29:04 last message repeated 3 times

2012 Jun 1 17:40:08 last message repeated 1 time

2012 Jun 1 17:41:12 last message repeated 3 times

Ivan Shirshin · ‎06-11-2012

Hi,

It seems that for this packet Hardware Type is wrong at 6 (it should be 1 for Ethernet), while Protocol Type 2048 is correct for IP.

You can span the inband port or enable ethanalyzer, and when this error happens, and stop the inband span or the ethanlayzer, and find the

source of the device.

N7K1# ethanalyzer local interface inband capture-filter "arp" write bootflash:arp.pcap (this will create a Wireshark file on bootflash which

you can tftp off of the switch and open it in Wireshark).

The time must match, meaning you need to stop the capture (Ctrl + C) as soon as you see the invalid ARP error message. You will need to open

second telnet session to switch to monitor show log for the error message.

Kind Regards,

Ivan

**Please grade this post if you find it useful.

Kind Regards,
Ivan

Muhammed AKYUZ · ‎06-11-2012

I have done that. I am able to get 10 packets only.. can i limit for 10 mb for example..?

Muhammed AKYUZ · ‎06-12-2012

Hi,

I am checking like this:

NX1# ethanalyzer local interface inband capture-filter "arp" limit-captured-frames 1000 detail | i Hardware|Src

Capturing on inband

Ethernet II, Src: 00:50:56:9b:00:3f (00:50:56:9b:00:3f), Dst: ff:ff:ff:ff:ff:ff (ff:ff:ff:ff:ff:ff)