Buy or Renew
Buy or Renew
cancel
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for 
Search instead for 
Did you mean: 
cancel
Start a conversation
5977
Views
0
Helpful
10
Replies

ICMP Reply destination MAC Address is incorrect

John.Senkovich
Level 1
Level 1

‎07-26-2011 06:17 AM - edited ‎03-07-2019 01:24 AM

While pinging a device, I get "Request Timed Out"

I ran Wireshark, and I see the request and reply message. Looking at the packet, I see that the reply includes an incorrect MAC Address for the destination (my laptop).

I checked the ARP table on the switch, it is correct (MAC  0021.86a0.ceb9), the Wireshark Packet includes the following MAC: 9021.90a0.90:b9.

I ran a debug ARP, and I did not see anything abnormal.

For reference, I am pinging from my laptop (laptop is directly connected to a L3 Switch) to a device in a different VLAN (also connected directly to the same L3 switch as my laptop).

Labels:
0 Helpful
10 Replies 10

milan.kulik
Level 10
Level 10

‎07-26-2011 07:05 AM

Hi,

where (on which device/port) are you capturing the packets by the Wireshark?

Isn't there the 9021.90a0.90:b9 MAC address of your switch port?

HTH,

Milan

0 Helpful

John.Senkovich
Level 1
Level 1
In response to milan.kulik

‎07-26-2011 07:13 AM

I am capturing packets on my laptop. The switch doesn't have any interfaces that start with a 9021 MAC. The source MAC Address in the packet is the switch's VLAN Interface. The destination should be my laptop's MAC.

When I ping directly from the L3 switch to my laptop it is successful, and show the proper destination MAC Address.

Thanks,
John

0 Helpful

John.Senkovich
Level 1
Level 1
In response to John.Senkovich

‎07-27-2011 05:01 AM

I'm kinda stuck on this... Does anyone have any ideas?

0 Helpful

Jon Marshall
Hall of Fame
Hall of Fame
In response to John.Senkovich

‎07-27-2011 05:06 AM

John

I checked the mac-address 9021.... for a vendor but it is not registered.

Can you do the ping again and post results of -

1) sh mac-address table

2) sh arp or sh ip arp

from the L3 switch.

** Edit - could you also post config of L3 switch.

Jon

0 Helpful

John.Senkovich
Level 1
Level 1
In response to Jon Marshall

‎07-27-2011 06:11 AM

That's the weird thing... It doesn't exist in the mac-address-table or as an arp entry. Also I can change the IP Address of my laptop to an available IP Address, and I get the same result.

Please note that the mac address of my laptop is not in this table. I setup my laptop with the IP Address 208.68.60.33 temporarly. The current host with the same IP experiences the exact same issue.

show ip arp

Protocol  Address          Age (min)  Hardware Addr   Type   Interface
Internet  10.251.250.3          208   00e0.ed14.25c0  ARPA   Vlan250
Internet  10.251.250.1           19   00e0.ed14.25c0  ARPA   Vlan250
Internet  10.251.250.6          147   0012.43ee.ef44  ARPA   Vlan250
Internet  10.251.250.5            -   0012.43b7.15c4  ARPA   Vlan250
Internet  10.251.250.4            -   0000.0c07.acfa  ARPA   Vlan250
Internet  10.29.164.149           0   842b.2b0c.8156  ARPA   Vlan164
Internet  10.29.164.148           0   0050.5640.6ebf  ARPA   Vlan164
Internet  10.29.164.143          97   0026.b957.0553  ARPA   Vlan164
Internet  10.29.164.142           0   0050.5643.fbd8  ARPA   Vlan164
Internet  10.29.164.141         147   842b.2b0c.8086  ARPA   Vlan164
Internet  10.29.164.140           2   0050.564d.15c6  ARPA   Vlan164
Internet  208.68.60.32            4   0050.5600.0d01  ARPA   Vlan60
Internet  208.68.60.33            0   0030.48bb.f80e  ARPA   Vlan60
Internet  208.68.61.11            0   0002.b3ad.4343  ARPA   Vlan61
Internet  208.68.61.13            2   0009.6b09.5184  ARPA   Vlan61
Internet  208.68.61.12            4   0009.6b89.b528  ARPA   Vlan61
Internet  10.29.164.21           97   2893.fe32.b241  ARPA   Vlan164
Internet  208.68.60.14            4   0002.b3f0.f62a  ARPA   Vlan60
Internet  10.29.164.20           97   2893.fe32.dac1  ARPA   Vlan164
Internet  208.68.61.14            3   0006.292f.333e  ARPA   Vlan61
Internet  208.68.61.5           104   0012.43ee.ef42  ARPA   Vlan61
Internet  208.68.60.4             -   0000.0c07.ac3c  ARPA   Vlan60
Internet  208.68.61.4             -   0000.0c07.ac3d  ARPA   Vlan61
Internet  208.68.60.5             -   0012.43b7.15c1  ARPA   Vlan60
Internet  208.68.60.6           118   0012.43ee.ef41  ARPA   Vlan60
Internet  208.68.61.6             -   0012.43b7.15c2  ARPA   Vlan61
Internet  208.68.61.25            2   000c.2956.fe78  ARPA   Vlan61
Internet  10.29.164.3           213   0012.43ee.ef43  ARPA   Vlan164
Internet  208.68.60.24            0   0030.482b.f85e  ARPA   Vlan60
Internet  208.68.61.24            0   000c.2932.edc7  ARPA   Vlan61
Internet  208.68.60.25            1   0030.48bb.2b1c  ARPA   Vlan60
Internet  10.29.164.2             -   0012.43b7.15c3  ARPA   Vlan164
Internet  208.68.60.26            0   0030.482b.f85e  ARPA   Vlan60
Internet  10.29.164.1             -   0000.0c07.aca4  ARPA   Vlan164
Internet  208.68.60.27            3   0002.557b.61f2  ARPA   Vlan60
Internet  208.68.60.28            0   0030.48bb.2b1c  ARPA   Vlan60
Internet  208.68.60.30            3   0050.56b2.6774  ARPA   Vlan60
Internet  208.68.60.16            0   0060.cf21.07f9  ARPA   Vlan60
Internet  208.68.61.16            3   0009.6b89.b4d0  ARPA   Vlan61
Internet  208.68.60.17            2   0009.6b71.050a  ARPA   Vlan60
Internet  208.68.61.18          174   0014.5e76.ed23  ARPA   Vlan61
Internet  208.68.60.19            0   000c.29d4.ae0d  ARPA   Vlan60
Internet  208.68.60.20            2   000c.2990.c344  ARPA   Vlan60
Internet  208.68.60.21            0   0002.b3ad.4342  ARPA   Vlan60
Internet  208.68.61.23            0   001a.6468.0834  ARPA   Vlan61
Internet  208.68.61.22           18   0009.6b2e.6a99  ARPA   Vlan61
Internet  208.68.61.107         174   0001.d71a.fbc1  ARPA   Vlan61
Internet  208.68.61.109          37   0001.d71a.fbc1  ARPA   Vlan61
Internet  208.68.61.108         162   0001.d71a.fbc1  ARPA   Vlan61
Internet  208.68.61.111         196   0001.d71a.fbc1  ARPA   Vlan61
Internet  208.68.61.110          43   0001.d71a.fbc1  ARPA   Vlan61
Internet  208.68.61.101         211   00e0.ed15.9f63  ARPA   Vlan61
Internet  208.68.61.100         233   00e0.ed16.8b1d  ARPA   Vlan61
Internet  208.68.61.102           5   00e0.ed16.8b1d  ARPA   Vlan61
Internet  208.68.61.121         231   0001.d71a.fbc1  ARPA   Vlan61
Internet  208.68.61.120         231   0001.d71a.fbc1  ARPA   Vlan61
Internet  208.68.61.123         198   00e0.ed16.8b1d  ARPA   Vlan61
Internet  208.68.61.122         231   0001.d71a.fbc1  ARPA   Vlan61
Internet  208.68.61.124           0   0001.d71a.fbc1  ARPA   Vlan61
Internet  208.68.61.126         138   0001.d71a.fbc1  ARPA   Vlan61
Internet  208.68.61.113         234   0001.d71a.fbc1  ARPA   Vlan61
Internet  208.68.61.112         234   0001.d71a.fbc1  ARPA   Vlan61
Internet  208.68.61.115         232   0001.d71a.fbc1  ARPA   Vlan61
Internet  208.68.61.114          43   0001.d71a.fbc1  ARPA   Vlan61
Internet  208.68.61.117         234   0001.d71a.fbc1  ARPA   Vlan61
Internet  208.68.61.116         234   0001.d71a.fbc1  ARPA   Vlan61
Internet  208.68.61.119         234   0001.d71a.fbc1  ARPA   Vlan61
Internet  208.68.61.118         234   0001.d71a.fbc1  ARPA   Vlan61

show mac-address-table

Vlan    Mac Address       Type        Ports

----    -----------       --------    -----

All    0100.0ccc.cccc    STATIC      CPU

All    0100.0ccc.cccd    STATIC      CPU

All    0180.c200.0000    STATIC      CPU

All    0180.c200.0001    STATIC      CPU

All    0180.c200.0002    STATIC      CPU

All    0180.c200.0003    STATIC      CPU

All    0180.c200.0004    STATIC      CPU

All    0180.c200.0005    STATIC      CPU

All    0180.c200.0006    STATIC      CPU

All    0180.c200.0007    STATIC      CPU

All    0180.c200.0008    STATIC      CPU

All    0180.c200.0009    STATIC      CPU

All    0180.c200.000a    STATIC      CPU

All    0180.c200.000b    STATIC      CPU

All    0180.c200.000c    STATIC      CPU

All    0180.c200.000d    STATIC      CPU

All    0180.c200.000e    STATIC      CPU

All    0180.c200.000f    STATIC      CPU

All    0180.c200.0010    STATIC      CPU

All    ffff.ffff.ffff    STATIC      CPU

  60    0000.0c07.ac3c    STATIC      CPU

  60    0002.557b.61f2    DYNAMIC     Fa1/0/13

  60    0002.b3ad.4342    DYNAMIC     Fa1/0/8

  60    0002.b3f0.f62a    DYNAMIC     Fa1/0/4

  60    0009.6b71.050a    DYNAMIC     Fa1/0/6

  60    000c.2990.c344    DYNAMIC     Fa1/0/8

  60    000c.29d4.ae0d    DYNAMIC     Fa1/0/8

  60    0012.43ee.ef41    DYNAMIC     Gi1/0/2

  60    0030.482b.f85e    DYNAMIC     Fa1/0/12

  60    0030.48bb.2b1c    DYNAMIC     Gi1/0/2

  60    0030.48bb.f80e    DYNAMIC     Fa1/0/38

  60    0050.5600.0d01    DYNAMIC     Gi1/0/1

  60    0060.cf21.07f9    DYNAMIC     Fa1/0/5

250    0000.0c07.acfa    STATIC      CPU

250    0012.43ee.ef44    DYNAMIC     Gi1/0/2

250    00e0.ed14.25c0    DYNAMIC     Gi1/0/2

   1    0012.43ee.ef02    DYNAMIC     Gi1/0/2

   1    0012.43ee.ef1c    DYNAMIC     Gi1/0/4

   1    2893.fe32.daae    DYNAMIC     Gi1/0/1

   1    5cf3.fc27.f941    DYNAMIC     Gi1/0/2

   1    5cf3.fc27.f945    DYNAMIC     Gi1/0/2

  61    0000.0c07.ac3d    STATIC      CPU

  61    0001.d71a.fbc1    DYNAMIC     Gi1/0/2

  61    0002.b3ad.4343    DYNAMIC     Gi1/0/2

  61    0006.292f.333e    DYNAMIC     Gi1/0/2

  61    0009.6b09.5184    DYNAMIC     Gi1/0/2

  61    0009.6b2e.6a99    DYNAMIC     Gi1/0/2

  61    0009.6b89.b4d0    DYNAMIC     Gi1/0/2

  61    0009.6b89.b528    DYNAMIC     Gi1/0/2

  61    000c.2956.fe78    DYNAMIC     Gi1/0/2

  61    0012.43ee.ef02    DYNAMIC     Gi1/0/2

  61    0012.43ee.ef42    DYNAMIC     Gi1/0/2

  61    001a.6468.0834    DYNAMIC     Gi1/0/2

  61    001a.646c.fda3    DYNAMIC     Gi1/0/2

  61    00e0.ed16.8b1d    DYNAMIC     Gi1/0/2

164    0000.0c07.aca4    STATIC      CPU

164    0012.43ee.ef43    DYNAMIC     Gi1/0/2

164    0050.5640.6ebf    DYNAMIC     Gi1/0/1

164    0050.5643.fbd8    DYNAMIC     Gi1/0/2

164    0050.564d.15c6    DYNAMIC     Gi1/0/2

164    2893.fe32.dac1    DYNAMIC     Gi1/0/1

164    842b.2b0c.8156    DYNAMIC     Gi1/0/1

Total Mac Addresses for this criterion: 62 Vlan    Mac Address       Type        Ports
----    -----------       --------    -----
All    0100.0ccc.cccc    STATIC      CPU
All    0100.0ccc.cccd    STATIC      CPU
All    0180.c200.0000    STATIC      CPU
All    0180.c200.0001    STATIC      CPU
All    0180.c200.0002    STATIC      CPU
All    0180.c200.0003    STATIC      CPU
All    0180.c200.0004    STATIC      CPU
All    0180.c200.0005    STATIC      CPU
All    0180.c200.0006    STATIC      CPU
All    0180.c200.0007    STATIC      CPU
All    0180.c200.0008    STATIC      CPU
All    0180.c200.0009    STATIC      CPU
All    0180.c200.000a    STATIC      CPU
All    0180.c200.000b    STATIC      CPU
All    0180.c200.000c    STATIC      CPU
All    0180.c200.000d    STATIC      CPU
All    0180.c200.000e    STATIC      CPU
All    0180.c200.000f    STATIC      CPU
All    0180.c200.0010    STATIC      CPU
All    ffff.ffff.ffff    STATIC      CPU
  60    0000.0c07.ac3c    STATIC      CPU
  60    0002.557b.61f2    DYNAMIC     Fa1/0/13
  60    0002.b3ad.4342    DYNAMIC     Fa1/0/8
  60    0002.b3f0.f62a    DYNAMIC     Fa1/0/4
  60    0009.6b71.050a    DYNAMIC     Fa1/0/6
  60    000c.2990.c344    DYNAMIC     Fa1/0/8
  60    000c.29d4.ae0d    DYNAMIC     Fa1/0/8
  60    0012.43ee.ef41    DYNAMIC     Gi1/0/2
  60    0030.482b.f85e    DYNAMIC     Fa1/0/12
  60    0030.48bb.2b1c    DYNAMIC     Gi1/0/2
  60    0030.48bb.f80e    DYNAMIC     Fa1/0/38
  60    0050.5600.0d01    DYNAMIC     Gi1/0/1
  60    0060.cf21.07f9    DYNAMIC     Fa1/0/5
250    0000.0c07.acfa    STATIC      CPU
250    0012.43ee.ef44    DYNAMIC     Gi1/0/2
250    00e0.ed14.25c0    DYNAMIC     Gi1/0/2
   1    0012.43ee.ef02    DYNAMIC     Gi1/0/2
   1    0012.43ee.ef1c    DYNAMIC     Gi1/0/4
   1    2893.fe32.daae    DYNAMIC     Gi1/0/1
   1    5cf3.fc27.f941    DYNAMIC     Gi1/0/2
   1    5cf3.fc27.f945    DYNAMIC     Gi1/0/2
  61    0000.0c07.ac3d    STATIC      CPU
  61    0001.d71a.fbc1    DYNAMIC     Gi1/0/2
  61    0002.b3ad.4343    DYNAMIC     Gi1/0/2
  61    0006.292f.333e    DYNAMIC     Gi1/0/2
  61    0009.6b09.5184    DYNAMIC     Gi1/0/2
  61    0009.6b2e.6a99    DYNAMIC     Gi1/0/2
  61    0009.6b89.b4d0    DYNAMIC     Gi1/0/2
  61    0009.6b89.b528    DYNAMIC     Gi1/0/2
  61    000c.2956.fe78    DYNAMIC     Gi1/0/2
  61    0012.43ee.ef02    DYNAMIC     Gi1/0/2
  61    0012.43ee.ef42    DYNAMIC     Gi1/0/2
  61    001a.6468.0834    DYNAMIC     Gi1/0/2
  61    001a.646c.fda3    DYNAMIC     Gi1/0/2
  61    00e0.ed16.8b1d    DYNAMIC     Gi1/0/2
164    0000.0c07.aca4    STATIC      CPU
164    0012.43ee.ef43    DYNAMIC     Gi1/0/2
164    0050.5640.6ebf    DYNAMIC     Gi1/0/1
164    0050.5643.fbd8    DYNAMIC     Gi1/0/2
164    0050.564d.15c6    DYNAMIC     Gi1/0/2
164    2893.fe32.dac1    DYNAMIC     Gi1/0/1
164    842b.2b0c.8156    DYNAMIC     Gi1/0/1
Total Mac Addresses for this criterion: 62

0 Helpful

Jon Marshall
Hall of Fame
Hall of Fame
In response to John.Senkovich

‎07-27-2011 06:16 AM

What device are you pinging ?

Can you post switch config and if possible could you post a wireshark capture of just ping from your laptop.

Jon

0 Helpful

Alvaro Garcia
Level 1
Level 1
In response to John.Senkovich

‎07-27-2011 06:23 AM

So, you are doing the packet capture from your laptop... and the topolgy is kinda like this:

YouLaptop------L3 Switch-----Remote PC

the behavior you are mentioning is only seeing on the ping response not the request.... correct?

You also mentioned that the destination MAC address of the ping response doesnt appear in the MAC-address table of the L3 switch which means that the switch should be flooding that packets over all the ports of VLAN 60.

I would suggest to sniff a different port of VLAN 60 on the switch just to confirm that the switch is do broadcasting those packets. Also sniff the the port where the Remote computer is connected in order to verify if the switch is getting the Ping response with that destination MAC address from the PC, if that is the case then you should check the PC.

0 Helpful

Alvaro Garcia
Level 1
Level 1
In response to John.Senkovich

‎07-27-2011 06:23 AM

Also post what kind of switch you are using and the IOS version running on it.

0 Helpful

John.Senkovich
Level 1
Level 1
In response to Alvaro Garcia

‎08-08-2011 05:22 AM

It is actually two switches using HSRP, there are two trunk connecting them. They were at one point a channel-group, but that has been removed, and spanning tree is now blocking one of the interfaces.

so the topology is:

access switch (item that I am pinging) --->  Switch1 (HSRP) ---> Switch2 (HSRP)  ---> my laptop

When I ping any of the interface addresses on Switch1 or Switch2, there are no issues. If I ping the "access switch" (which happens to be in a different VLAN) this is where I'm experiencing the issue (reply is not sending to my laptop's NIC MAC Address, but another all together. I have tried connecting my laptop to Switch1, and got the same result. Please note that Switch1 is currently the active HSRP node for all VLAN's.

Also, please note, that not all nodes are working this way, it appears to be random devices that exizibit this behavior.

Please see below for the ICMP request and reply packet tace...

In this case, my laptop is 208.68.60.33, and the access switch that I am pinging is 10.29.164.20

No.     Time            Source                Destination           Protocol Info
     23 09:32:02.240060 208.68.60.33          10.29.164.20          ICMP     Echo (ping) request  (id=0x0300, seq(be/le)=11008/43, ttl=128)

Frame 23: 74 bytes on wire (592 bits), 74 bytes captured (592 bits)
Ethernet II, Src: Universa_a0:ce:b9 (00:21:86:a0:ce:b9), Dst: All-HSRP-routers_3c (00:00:0c:07:ac:3c)
Internet Protocol, Src: 208.68.60.33 (208.68.60.33), Dst: 10.29.164.20 (10.29.164.20)
Internet Control Message Protocol

No.     Time            Source                Destination           Protocol Info
     24 09:32:02.241124 10.29.164.20          208.68.60.33          ICMP     Echo (ping) reply    (id=0x0300, seq(be/le)=11008/43, ttl=254)

Frame 24: 74 bytes on wire (592 bits), 74 bytes captured (592 bits)
Ethernet II, Src: Cisco_b7:15:c1 (00:12:43:b7:15:c1), Dst: GemtekTe_a0:00:b9 (00:21:00:a0:00:b9)
Internet Protocol, Src: 10.29.164.20 (10.29.164.20), Dst: 208.68.60.33 (208.68.60.33)
Internet Control Message Protocol

EDIT: Please also note that the MAC Address in the packet trace is different than the above ARP Table... This is not an issue, my laptop was used temporarily in place of the actual node. The ARP Table did have the correct entry during the duration of this test. Also, I also attempted this test after inputting a static ARP Entry into both Switch1 and Switch2. Using the static ARP entry resulted with the same outcome.

0 Helpful

John.Senkovich
Level 1
Level 1

‎08-15-2011 05:52 AM

Okay, it appears that creating setting native VLAN's on the trunks within the environment solved this issue. Can anyone explain why this is the case... This environment has been running without issues for at least 3 months before the problems started. Also, not all devices were negatively affected, probably only about 5% of hosts were affected.

Thanks,

John

0 Helpful
Customers Also Viewed These Support Documents
Review Cisco Networking for a $25 gift card