How to clear arp in 2960s ?

ilya_tyapugin · ‎03-30-2016

Hello, how to clear incomplete arp in 2960s ?

I waited for more than 4 hours, but mac address is still in the mac table.

DMZ_SWITCH#sh arp
Protocol Address          Age (min) Hardware Addr   Type   Interface
Internet 192.168.8.26            -   64a0.e79c.5341 ARPA   Vlan46
Internet 192.168.8.240           0   Incomplete      ARPA
Internet 192.168.8.252           7   58ac.78b4.1b53 ARPA   Vlan46
Internet 192.168.8.253          19   58ac.78b4.1e63 ARPA   Vlan46
Internet 192.168.8.254           5   0000.0c9f.f02e ARPA   Vlan46

DMZ_SWITCH#clear arp

DMZ_SWITCH#
DMZ_SWITCH#sh arp
Protocol Address          Age (min) Hardware Addr   Type   Interface
Internet 192.168.8.26            -   64a0.e79c.5341 ARPA   Vlan46
Internet 192.168.8.240           0   Incomplete      ARPA
Internet 192.168.8.254           0   0000.0c9f.f02e ARPA   Vlan46

DMZ_SWITCH#clear ip arp 192.168.8.240

DMZ_SWITCH#sh arp
Protocol Address          Age (min) Hardware Addr   Type   Interface
Internet 192.168.8.26            -   64a0.e79c.5341 ARPA   Vlan46
Internet 192.168.8.240           0   Incomplete      ARPA
Internet 192.168.8.254           0   0000.0c9f.f02e ARPA   Vlan46

DMZ_SWITCH#clear arp-cache

DMZ_SWITCH#sh arp
Protocol Address          Age (min) Hardware Addr   Type   Interface
Internet 192.168.8.26            -   64a0.e79c.5341 ARPA   Vlan46
Internet 192.168.8.240           0   Incomplete      ARPA
Internet 192.168.8.254           0   0000.0c9f.f02e ARPA   Vlan46

===========================================================

WS-C2960S-24PS-L 12.2(55)SE3 C2960S-UNIVERSALK9-M

What the problem could be?

Mark Malone · ‎03-30-2016

what is that ip address 192.168.8.240 ? where is it connected do you have the mac address , its incomplete so there could be a nic or cable issue on the actual device ,, trace the mac shut the port , clear the mac table for the specific mac then clear the arp for it

ilya_tyapugin · ‎03-30-2016

Yes it is 192.168.8.240, no ip 8.240 in the network.

Before there was core switch with ip address of 192.168.8.240, than I changed 8.240 to 8.253 and apply hsrp ip 8.254 to this vlan.

Also we have 3750, on 3750 clear arp worked fine, but on 2960s it is still in arp table.

Can not trace or can not be listed 8.240 in mac address table of the core switch.

Topology network pretty simple , 2Xcore switches (nexus 9300) and VPC access swithes. And the problem has only one 2960s.

Could be bug?

devils_advocate · ‎03-30-2016

Sounds to me like something on the network is still trying to communicate with 192.168.8.240.

If anything is trying to communicate with this address, the arp will be sent but as there is no response, the MAC address will be listed as 'incomplete' in the ARP cache.

I would check your hosts to see if you have any that still have 8.240 as their default gateway, perhaps a Non DHCP host still has a static configuration.

If you were to login to your switch and ping any IP address that was not in use, you would see an 'incomplete' for this entry in the ARP cache because there was no reply.

Thanks

pwwiddicombe · ‎03-30-2016

... and presumably it is being polled regularly, keeping the entry alive. If you have no ideas which static entry is causing it, you could put wireshark on a port on that vlan and capture for a short while (i.e. 10 minutes ?) and check through the frames for that request.

ilya_tyapugin · ‎03-30-2016

Yes you are right, cisco switch itself pooling arp request for 192.168.8.240, Now how to understand Why it is doing this, the only configuration is ip defaul-gateway 192.168.8.254

ilya_tyapugin · ‎03-30-2016

Very strange behavior , how it could be ?

interface Vlan1
no ip address
no ip route-cache
shutdown
!
interface Vlan46
ip address 192.168.8.26 255.255.255.0
!
ip default-gateway 192.168.8.254
ip http server
ip http secure-server
ip sla enable reaction-alerts
logging 192.168.5.9

So , default gateway is 192.168.8.254 (HSRP) real is 8.252 , now I ping

ping 192.168.5.41

Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 192.168.5.41, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 1/2/6 ms

DMZ_SWITCH#ping 192.168.5.9

Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 192.168.5.9, timeout is 2 seconds:
.....
Success rate is 0 percent (0/5)
DMZ_SWITCH#
DMZ_SWITCH#
DMZ_SWITCH#trace
DMZ_SWITCH#traceroute 192.168.5.41

Type escape sequence to abort.
Tracing the route to 192.168.5.41

1 192.168.8.252 0 msec 0 msec 0 msec
2 * * *
3 * * *
4
DMZ_SWITCH#
DMZ_SWITCH#traceroute 192.168.5.9

Type escape sequence to abort.
Tracing the route to 192.168.5.9

1 * * *
2 * * *
3 * * *
4

It is looks like it wants to use 8.240 as a gateway for 5.9 only , but for 5.41 it is using correct 8.254

devils_advocate · ‎03-30-2016

You did not get an ICMP reply for 192.168.5.9 when you tried to ping it so I would expect a traceroute to go nowhere as it uses the ICMP protocol.

I see no issues with what you posted above.

The issue is likely not with your switch, there is probably a host somewhere on the network which is using the 192.168.8.240 address for something, hence why the ARP entry is always there.

Do you have any issues or just questioning why the Incomplete ARP entry is there for 8.240?

ilya_tyapugin · ‎03-30-2016

I have an issue , on 192.168.5.9 we have monitoring program, prtg, and it can not monitor my switch - 192.168.8.26 , no connection between them .

And why when I ping or trace 192.168.5.9 it is not using default gaytway? When I ping or trace 192.168.5.41 it is using correct gateway ?

devils_advocate · ‎03-30-2016

Can you post results of the following from that switch:

#show ip route 192.168.5.9

Possibly also post the full config of the switch.

Thanks

ilya_tyapugin · ‎03-30-2016

no ip routing jast ip default-gateway

DMZ_SWITCH# sh ip route
^
% Invalid input detected at '^' marker.

devils_advocate · ‎03-30-2016

Ahhh ok well can you confirm the 192.168.5.9 address has the correct default gateway set?

What L3 device on your network is hosting the default gateway for the 192.168.5.x subnet?

Thanks

ilya_tyapugin · ‎03-30-2016

Yes I confirm 192.168.5.9 uses correct gateway, L3 on core nexus switches for all vlans 192.168.8.x and 192.168.5.x

I Use wareshark and 192.168.8.26 ask arp for 192.168.8.240 , now I confused Why ?

And I found another cisco swich is asking arp for 192.168.8.240 , look at this another cisco switch

19_Floor#sh ip route
Default gateway is 192.168.8.254

Host Gateway Last Use Total Uses Interface
192.168.5.16 192.168.8.240 0:00 6345 Vlan46

19_Floor#sh arp
Protocol Address          Age (min) Hardware Addr   Type   Interface
Internet 192.168.8.13            -   001e.135b.36c1 ARPA   Vlan46
Internet 192.168.8.18            0   001b.2b80.d2c3 ARPA   Vlan46
Internet 192.168.8.31           13   6c99.89cf.70c1 ARPA   Vlan46
Internet 192.168.8.240           0   Incomplete      ARPA
Internet 192.168.8.254         193   0000.0c9f.f02e ARPA   Vlan46

19_Floor#sh run | include 192.168.8.240
19_Floor#

interface Vlan1
no ip address
!
interface Vlan46
ip address 192.168.8.13 255.255.255.0
!
ip default-gateway 192.168.8.254
ip classless
ip http server
ip http secure-server

Do you have any idea from where this switch take this configuration?

19_Floor#sh ip route
Default gateway is 192.168.8.254

Host Gateway Last Use Total Uses Interface
192.168.5.16 192.168.8.240 0:00 6345 Vlan46

The only configuration are Ip defaul-gateway 192.168.8.254

sh run | include 192.168.8.240

nothing

ilya_tyapugin · ‎03-30-2016

Looks like it is IP Redirect issue

Mark Malone · ‎03-30-2016

have you tried clearing the ip from the arp table at layer 3 , clear ip arp 192.168.8.240 , if its still coming back after that something might be using it

you could setup advanced ip scanner and see if its live somewhere , its freeware