show arp issue in 2960X

[musikman1988]

Hi All,

Our office network setup is ISP-------ASA---------3750---------2960X (stack by 4)-----------wired users

Recently, I use command "show arp" in 2960X, the output as below,

In arp table, I can't see wired PC mac address, and also I do a test at last,

I filter my PC using my wired PC IP address (10.27.82.72), but no result in output.

I just want to know what reason cause this issue?

What should I to do that can solve this problem?

Thanks in advance,

swt001#sh arp
Protocol  Address          Age (min)  Hardware Addr   Type   Interface
Internet  10.25.2.222           172   0017.e048.de41  ARPA   Vlan48
Internet  10.25.3.200           160   0017.e048.de41  ARPA   Vlan48
Internet  10.25.31.25           236   0017.e048.de41  ARPA   Vlan48
Internet  10.25.47.33           131   0017.e048.de41  ARPA   Vlan48
Internet  10.25.48.50           256   0017.e048.de41  ARPA   Vlan48
Internet  10.25.48.51           163   0017.e048.de41  ARPA   Vlan48
Internet  10.27.36.101           46   0017.e048.de41  ARPA   Vlan48
Internet  10.27.47.25           162   0017.e048.de41  ARPA   Vlan48
Internet  10.27.82.5            236   0017.e048.de41  ARPA   Vlan48
Internet  10.27.82.8            221   0017.e048.de41  ARPA   Vlan48
Internet  10.27.82.15            30   0017.e048.de41  ARPA   Vlan48
Internet  10.27.82.20           191   0017.e048.de41  ARPA   Vlan48
Internet  10.27.82.21           209   0017.e048.de41  ARPA   Vlan48
Internet  10.27.82.24           212   0017.e048.de41  ARPA   Vlan48
Internet  10.27.82.37           128   0017.e048.de41  ARPA   Vlan48
Internet  10.27.82.43           140   0017.e048.de41  ARPA   Vlan48
Internet  10.27.82.49           186   0017.e048.de41  ARPA   Vlan48
Internet  10.27.82.61            12   0017.e048.de41  ARPA   Vlan48
Internet  10.27.82.63           229   0017.e048.de41  ARPA   Vlan48
Internet  10.27.82.64            22   0017.e048.de41  ARPA   Vlan48
Internet  10.27.82.69           245   0017.e048.de41  ARPA   Vlan48
Internet  10.27.82.75            63   0017.e048.de41  ARPA   Vlan48
Internet  10.27.82.91            80   0017.e048.de41  ARPA   Vlan48
Internet  10.27.82.203          178   0017.e048.de41  ARPA   Vlan48
Internet  10.27.95.61             -   2834.a26d.62c1  ARPA   Vlan48
Internet  192.168.1.1             -   2834.a26d.62c2  ARPA   Vlan99
swt001#
swt001#sh arp | in 10.27.82.72
swt001#

[Aaron Harrison]

Hi

You have a 29xx, then at 3750, then an ASA.

Which device is the default gateway for your PC? I'm guessing it is the ASA or the 3750.

If the 29xx only has an address for administration, then it will only need/have ARP entries for devices it has communicated with. E.g. if you ping your PC from the switch, it will probably learn an ARP entry.

Aaron

[musikman1988]

Hi Bro,

Thanks for your reply.

I agree with u, I just search on google, the answer is the same with u.

2960 is L2 switch, so it don't have ARP table. so I must run command "show arp" on gateway 3750 switch.

BTW, but I have another quesion, I just saw some IP address with the same MAC address "0017.e048.de41", I just want to know which interface has this Mac address, the VLAN 48 interface, or another?

Thanks in advance,

/Frank

[devils_advocate]

Tracing a MAC address is fairly straight forward.

#show mac-address-table 0017.e048.de41

It may also be 

#show mac address-table 0017.e048.de41

This will list the Outgoing interface that the switch will use to forward frames destined for that MAC address. It does not automatically mean that interface HAS that MAC because it could be a trunk port.

If the outgoing interface turns out to be a Trunk port, logon to the switch connected to that link and check its MAC table in the same way. Keep going until you reach the interface which has the MAC address you are looking for. It could be a virtual interface on a Switch/Router (SVI or Loopback), a Layer 3 address on a Router (i.e one with an IP address) or a normal host port.

Hope that helps

[Aaron Harrison]

Hi Frank

You can follow devils_advocotes' advice for tracing MAC addresses.

In reference to your earlier response - a L2 switch DOES have an ARP table, it just isn't as full as the 3750 will be, as it only has entries in the table for hosts on the same subnet that it has communicated with. They also time out after a while. Both devices have an ARP table, it's just that the 3750 is bigger as it talks to more devices more often.

Aaron

[musikman1988]

Hi, Aaron,

Okay, I got it.

Thanks for your help and explain this issue !!

BR

Frank

[Aaron Harrison]

No problem.

Aaron

Please remember to rate useful responses to help highlight useful content..

[musikman1988]

Hi Bro,

Many thanks, thanks for sooooo specific explaination.

It's very helpful for me. I will follow you to check it.

Thanks again.

/Frank

[devils_advocate · Accepted solution]

In terms of its 'arp cache', I would think of a Layer 2 switch as simply a host like a PC.

The Layer 2 switch has an IP address for management so the entries in its arp cache should only be for the same subnet the management address is on.

if you bring up a command prompt on a windows pc and run the command 'arp -a', it will show the local arp cache on this PC. Running the 'show arp' on a switch is the same thing in essence, it will simply show the ARP entries present for the subnet that the switches management address is on.

The 3750 however is Routing, therefore its ARP cache will show entries for each of its connected routes.