Tek-Tips is the largest IT community on the Internet today!

Members share and learn making Tek-Tips Forums the best source of peer-reviewed technical information on the Internet!

  • Congratulations strongm on being selected by the Tek-Tips community for having the most helpful posts in the forums last week. Way to Go!

Dynamic ARP insepection question

Status
Not open for further replies.

MrOyvind

Technical User
Aug 10, 2007
99
NO
Hi

Log from one of the switches in our Intranet.

un 20 13:08:29.667 CEST: %SW_DAI-4-DHCP_SNOOPING_DENY: 1 Invalid ARPs (Req) on Fa0/14, vlan 266.([0013.21f4.27de/10.101.7.34/0000.0000.0000/10.101.7.1/13:08:28 CEST Wed Jun 20 2012])

IP adress on host connected to Fa0/14 : 10.101.7.34
Default gateway : 10.101.7.1

The reason is maybe something wrong with the ARP table or the DHCP snooping bindings, maybe a man in the middle attack.
Need to know the location of the host that was the reason is located. From another host in the the network, or the host on Fa 0/14 ?
Req means request so maybe something was wrong with the MAC to IP bindings for the host on Fa0/14 ?



Thank you,

Best regards,

Oyvind




 
can you issue a traceroute command for the wanted host and the switch management IP? post the output please.
 
Hi

ARP inspection is feature for the local network.
What to do with traceroute and the managment IP address isolated in another VLAN ?
 
You receive this message when the MAC address does not match the binding. In order to display the DHCP snooping binding entries, use the show ip dhcp snooping binding command. If the device does not use DHCP or the information is correct and you trust the device on the port, you can enable trust on that port with the ip arp inspection trust command.

Also, DHCP snooping must be enabled in order to permit ARP packets that have dynamically assigned IP addresses with the ip dhcp snooping command.
 
Status
Not open for further replies.

Part and Inventory Search

Sponsor

Back
Top