When Dell switch directly connects to S12700, most of users under Dell switch can’t ping S127000:
Alarm Information
There are a lot of ARP Attacks in alarm log
Check the ARP which IP ping timeout, there is no ARP or Incomplete ARP
Handling Process
Checked STP TC statistics, there are a large number of TC packets, and they increase very fast, 3 per second.
After configuring arp topology-change disable and mac-address update arp, ARP table of the S12700 was stable.
Root Cause
Since the S12700 kept receiving TC packets, according to the STP principle, if STP device receives any TC, the device should delete all ARP and learn them again. During this time, a lot of ARP-miss messages are sent to the CPU and incomplete ARP table is created; since S12700 keeps receiving TC, the above process can’t stop, it keeps on repeating
That is the reason why S12700 always has some ARP can not be learned , thus causing ping timeouts, or intermittency.
Solution
1. Configure the arp topology-change disable to disable the function of deleting ARP by receiving TC( when device receives TC, doesn’t delete ARP anymore)
2. Configure mac-address update arp to enable MAC update ARP(when MAC table out interface changes, update ARP table)
Notice: if only arp topology-change disable, the ARP table can’t be updated by TC. So we need to configure mac-address update arp to update ARP table
Suggestions
In Most cases, the root cause of the issue is poor configuration of STP
Troubleshoot the network, find the root cause of peer device sending TC, and remove it
