Jaycee's Networking

April 23, 2009

Troubleshooting with ARP

Filed under: Troubleshoot — Tags: — Jaycee @ 4:42 pm

Problem:

All the hosts in the 192.168.10.0/24 subnet of the LAN are facing connectivity issues. The regular applications like web and e-mail are either not working or are extremely slow.

Troubleshooting:

1. Ping the default gateway to verify the connectivity.

2. Ping replies from gateway (192.168.10.254) are successful.

3. Ping to any address beyond the (192.168.10.254) interface (Ethernet 0) fails.

4. do “sh int e0“:

Ethernet0 is up, line protocol is up
Hardware is QUICC Ethernet, address is 0010.7bcc.57eb
Internet address is 192.168.10.254/24

5. do “arp -a” to check the local arp table:

C:\> arp -a
Internet Address   Physical Address     Type
192.168.10.254      00-d0-c8-af-e2-5e dynamic

* The incorrect mapping misdirects all the Internet traffic to the host with the wrong MAC.
=> Possible causes of the incorrect entry:

a. IP of the default gateway is used by another host in the local subnet.
b. A local host is running a malicious program to poison the arp table of all the hosts in the subnet.

6. Clear the arp table and manually map the IP:

C:\> arp -d 192.168.100.254
C:\> arp -s 192.168.10.254 00-10-7b-cc-57-eb

7. Verify the arp table:

C:\> arp -a
Internet Address   Physical Address     Type
192.168.10.254      00-10-7b-cc-57-eb  static

Advertisements

Leave a Comment »

No comments yet.

RSS feed for comments on this post. TrackBack URI

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s

Blog at WordPress.com.

%d bloggers like this: