Got it

ARP Probe question

Created: Nov 24, 2021 20:50:50Latest reply: Dec 2, 2021 09:01:10 277 6 0 0 0
  Rewarded HiCoins: 0 (problem resolved)

Hi Team,


I have a question with regard to ARP Probe packets. In the logging of an CE6880 we saw a couple of logs:

%ARP/4/ARP_IP_CONFLICT_DETECT

%ARP/4/ARP_DUPLICATE_IPADDR

This messages happens often on the network with different MAC addresses that want to take the address of the default gateway.


After investigation, we have noticed no Rogue DHCP servers and that clients do not actually take on the gateway address but send out an ARP Probe packet. I have read online that an ARP Probe packet is meant for Duplicate Address Detection. But I have a couple of questions.


1. On client level, when does a client send out an ARP Probe? Is this before the DHCP request process?

2. Can I somehow prevent clients from asking if the gateway address is available?


Thank you!

Featured Answers

Recommended answer

chenhui
Admin Created Nov 25, 2021 06:09:37

Hi,
1. On client level, when does a client send out an ARP Probe? Is this before the DHCP request process?
====== Usually, the gratuitous ARP packet is sent by the DHCP client. DHCP client will send gratuitous ARP packet after it receives the DHCP ACK packet from the DHCP server.

2. Can I somehow prevent clients from asking if the gateway address is available?
====== Well, I don't think that is caused due to the client sending the ARP probe message. The gratuitous ARP packet is sent when the client wants to detect the potential IP address confliction, in other words, the client device declares that it owns the IP address. Actually, this IP is the default gateway. So, I would suggest that you make an inspection of whether the client is configured with the static IP address, which causes it to send the ARP probe messages.
View more
  • x
  • convention:

chantha
chantha Created Nov 25, 2021 06:53:25 (0) (0)
 
All Answers
Hello User. we are reviewing your question and we will answer you shortly. Thanks.
View more
  • x
  • convention:

good
View more
  • x
  • convention:

Hi,
1. On client level, when does a client send out an ARP Probe? Is this before the DHCP request process?
====== Usually, the gratuitous ARP packet is sent by the DHCP client. DHCP client will send gratuitous ARP packet after it receives the DHCP ACK packet from the DHCP server.

2. Can I somehow prevent clients from asking if the gateway address is available?
====== Well, I don't think that is caused due to the client sending the ARP probe message. The gratuitous ARP packet is sent when the client wants to detect the potential IP address confliction, in other words, the client device declares that it owns the IP address. Actually, this IP is the default gateway. So, I would suggest that you make an inspection of whether the client is configured with the static IP address, which causes it to send the ARP probe messages.
View more
  • x
  • convention:

chantha
chantha Created Nov 25, 2021 06:53:25 (0) (0)
 
Posted by chenhui at 2021-11-25 06:09 Hi,1. On client level, when does a client send out an ARP Probe? Is this before the DHCP request pro ...
Hi Chenhui,

Thank you for your reply and explanation :).
I did some more research and found the following documents:
https://support.huawei.com/enterprise/en/knowledge/EKB1100047263
https://support.huawei.com/enterprise/en/knowledge/EKB1100057529

I do not think that the clients use a static address since there are a lot of different clients.

With kind regards,

Alvaro Tombokan
View more
  • x
  • convention:

Posted by alvaro_tombokan at 2021-11-26 07:50 Hi Chenhui,Thank you for your reply and explanation :).I did some more research and found the foll ...
Hi,
Is it possible to locate the device that leads the confilication?
View more
  • x
  • convention:

Comment

You need to log in to comment to the post Login | Register
Comment

Notice: To protect the legitimate rights and interests of you, the community, and third parties, do not release content that may bring legal risks to all parties, including but are not limited to the following:
  • Politically sensitive content
  • Content concerning pornography, gambling, and drug abuse
  • Content that may disclose or infringe upon others ' commercial secrets, intellectual properties, including trade marks, copyrights, and patents, and personal privacy
Do not share your account and password with others. All operations performed using your account will be regarded as your own actions and all consequences arising therefrom will be borne by you. For details, see " User Agreement."

My Followers

Login and enjoy all the member benefits

Login

Block
Are you sure to block this user?
Users on your blacklist cannot comment on your post,cannot mention you, cannot send you private messages.
Reminder
Please bind your phone number to obtain invitation bonus.