Show IP ARP Showing 'Incomplete' Entries

[oliclarke7]

Hi Everyone,

I am currently experiencing the below issue.

I have about 300 clients connected to an SSID and only 20 of them have managed to receive IP's. These are not geographically linked to each other (for instance, 2 people could be standing next to each other and 1 manages to get an IP whereas the other doesn't).

When looking on the router, i see in the ARP table that there are a very high amount of 'Incomplete' entries. This to me would indicate that there is something wrong with the LAN infrastructure as this could be the expected behaviour of VLAN misconfiguration for example... however because of what i said above, this does not appear to be the case. The devices all receive a 169.x.x.x address. DHCP functionality has been confirmed. I have just requested that a device be statically assigned an IP and see if that can connect.

I have tried debugging the ARP and have got the following message multiple times for different MAC sources:

*Sep 19 08:52:55.799: IP ARP req filtered src 169.254.251.40 ab10.xxxx.xxxx, dst 169.254.251.40 0000.0000.0000 wrong cable, interface GigabitEthernet0/0.123

I have also just performed 'debug arp dynamic' and got the following output:

*Sep 19 09:06:13.615: ARP DYNAMIC: timer expired on Incomplete ARP for 10.x.x.134 with tableid 0

Can anyone shed some light on what this means? If you would like any more information on the matter or can recommend any further debugging techniques i would be greatly appreciative. 

Kind regards,

Oli

[Seb Rupik]

Hi there,

The 'wrong cable' element of the IP ARP log entry indicates the source IP address of the ARP request is outside of the subnet range of the interface recieving it (Gi0/0.123) .

What is the IP config on Gi0/0.123 ? 

What is the DHCP scope information for that VLAN?

Sounds like you may have a subnet mask mis-match.

cheers,

Seb.

[Richard Burts]

Oli

First let us clarify the meaning of the incomplete entries in the arp table. When the IOS device attempts to access some IP address that should be locally connected then it will generate an arp request for that address and will place an entry into the arp table for that address. Since we do not yet know the mac address associated with the address the arp entry is incomplete. If the IOS device receives an arp response then it updates the entry in the arp table with the correct mac address. But if no response is received then the entry remains incomplete until it is removed from the arp table. So if you are seeing many incomplete entries in the arp table then your IOS device is attempting to reach many IP addresses but is not receiving arp responses for those addresses. It is possible that this behavior may be related to the number of devices that are receiving the 169.254 addresses.

Seb is correct in discussing the error message about wrong cable. IOS does logic in processing arp requests that attempts to validate the source address of the arp request. Since arp is supposed to be a local function the assumption is that the source address of the arp request should be in the same subnet that is assigned to the interface. Clearly GigEther0/0.123 is assigned some subnet that is not 169.254 and so when it receives arp requests with source address in 169.254 it decides that these requests are not valid.

Where is the DHCP set up for this subnet? Is it on a server or on the router? Can you check the status of the DHCP scope. If only about 20 users receive appropriate IP addresses via DHCP then it suggests that there might be some problem with the DHCP scope. Is it possible that the scope is not large enough? Is it possible that there is some issue with some addresses in the scope and the server will not use them? Are there any messages in the logs for the server about issues with this scope?

HTH

Rick