I'll have to go back and double-check. Since the ARP was a reply, I was assuming the original request would have populated the L2 table correctly. The logs didn't indicate any weird flapping. But I'll double-check the flooding. It was lots of random destination addresses, none of them common to the server I was running wireshark on. I'll check it out again to be sure though.
Thanks, Chuck -----Original Message----- From: Lee [mailto:[email protected]] Sent: Friday, August 19, 2011 11:05 PM To: Chuck Church Cc: NSP - Cisco Subject: Re: [c-nsp] ARP oddness Unicast flooding? You didn't say if the destination MAC address was known on the switch or no.. Lee On 8/19/11, Chuck Church <[email protected]> wrote: > Anyone, > > Researching some issues at a remote site, seeing something I don't > think should happen. A packet capture on this remote server using wireshark > and focusing in on ARP is seeing all the requests (as I'd expect), but I'm > also seeing unicast replies that I shouldn't. The MAC address table on the > switch I'm attached to shows only the MAC of this remote server on that > port. There are no SPAN sessions on the switch either. The destination > addresses aren't multicast, they're true unicast. Yet I'm seeing all these > unicasts that aren't my mac address. Is there some function built into a > Cisco switch that broadcasts these to make them act like gratuitous ARPs, or > am I really seeing something that shouldn't happen? It's on a Sup2+ 4500, > running 12.2(25)EWA10 (I know it's ancient, vendor owns it...) > > Thanks, > > Chuck > _______________________________________________ > cisco-nsp mailing list [email protected] > https://puck.nether.net/mailman/listinfo/cisco-nsp > archive at http://puck.nether.net/pipermail/cisco-nsp/ > _______________________________________________ cisco-nsp mailing list [email protected] https://puck.nether.net/mailman/listinfo/cisco-nsp archive at http://puck.nether.net/pipermail/cisco-nsp/
