cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
890
Views
0
Helpful
0
Replies

Missing ARP reply

Marks Maslovs
Level 1
Level 1

               Hi guys!

I've found one inconsintency between what "debug arp packets" shows and wireshark pcap's.

Here is the output from debug arp packets:

LC/0/2/CPU0:Feb 14 15:08:30.530 : arp[116]: ARP-PKT: rcvd req src 10.61.0.37 0040.4369.776a,

LC/0/1/CPU0:Feb 14 15:08:30.530 : arp[116]: ARP-PKT: rcvd req src 10.61.0.37 0040.4369.776a,

LC/0/2/CPU0:Feb 14 15:08:30.530 : arp[116]:          dst 10.61.0.1 0000.0000.0000 if:BVI611

LC/0/2/CPU0:Feb 14 15:08:30.530 : arp[116]: ARP-PKT: send rep src 10.61.0.1 0000.0c07.ac0a,

LC/0/2/CPU0:Feb 14 15:08:30.531 : arp[116]:          dst 10.61.0.37 0040.4369.776a if:BVI611

LC/0/1/CPU0:Feb 14 15:08:30.530 : arp[116]:          dst 10.61.0.1 0000.0000.0000 if:BVI611

LC/0/1/CPU0:Feb 14 15:08:30.530 : arp[116]: ARP-PKT: send rep src 10.61.0.1 0000.0c07.ac0a,

LC/0/1/CPU0:Feb 14 15:08:30.530 : arp[116]:          dst 10.61.0.37 0040.4369.776a if:BVI611

LC/0/2/CPU0:Feb 14 15:08:35.600 : arp[116]: ARP-PKT: rcvd req src 10.61.0.37 0040.4369.776a,

LC/0/1/CPU0:Feb 14 15:08:35.600 : arp[116]: ARP-PKT: rcvd req src 10.61.0.37 0040.4369.776a,

LC/0/2/CPU0:Feb 14 15:08:35.600 : arp[116]:          dst 10.61.0.1 0000.0000.0000 if:BVI611

LC/0/2/CPU0:Feb 14 15:08:35.600 : arp[116]: ARP-PKT: send rep src 10.61.0.1 0000.0c07.ac0a,

LC/0/2/CPU0:Feb 14 15:08:35.601 : arp[116]:          dst 10.61.0.37 0040.4369.776a if:BVI611

LC/0/1/CPU0:Feb 14 15:08:35.600 : arp[116]:          dst 10.61.0.1 0000.0000.0000 if:BVI611

LC/0/1/CPU0:Feb 14 15:08:35.600 : arp[116]: ARP-PKT: send rep src 10.61.0.1 0000.0c07.ac0a,

LC/0/1/CPU0:Feb 14 15:08:35.600 : arp[116]:          dst 10.61.0.37 0040.4369.776a if:BVI611

LC/0/2/CPU0:Feb 14 15:08:40.670 : arp[116]: ARP-PKT: rcvd req src 10.61.0.37 0040.4369.776a,

LC/0/1/CPU0:Feb 14 15:08:40.670 : arp[116]: ARP-PKT: rcvd req src 10.61.0.37 0040.4369.776a,

LC/0/2/CPU0:Feb 14 15:08:40.670 : arp[116]:          dst 10.61.0.1 0000.0000.0000 if:BVI611

LC/0/2/CPU0:Feb 14 15:08:40.670 : arp[116]: ARP-PKT: send rep src 10.61.0.1 0000.0c07.ac0a,

LC/0/2/CPU0:Feb 14 15:08:40.671 : arp[116]:          dst 10.61.0.37 0040.4369.776a if:BVI611

LC/0/1/CPU0:Feb 14 15:08:40.670 : arp[116]:          dst 10.61.0.1 0000.0000.0000 if:BVI611

LC/0/1/CPU0:Feb 14 15:08:40.670 : arp[116]: ARP-PKT: send rep src 10.61.0.1 0000.0c07.ac0a,

LC/0/1/CPU0:Feb 14 15:08:40.670 : arp[116]:          dst 10.61.0.37 0040.4369.776a if:BVI611

Here is a screenshot from wireshar pcap:

ScreenHunter_35 Feb. 15 10.27.jpg

As You can see bolded replies are missing.

Anyone have any idea were could they disappear? Maybe anyone have any suggestion, what could be checked to find the reason of such issue.

Thank You in advance!

0 Replies 0