Contents

Overview

What is an ARP probe?

Troubleshooting

Workaround

Reference bugs

Overview

The document is to help with understanding and remediating the cause of the error message.

2013 Oct 25 15:23:17 N7K  %ARP-3-DUP_VADDR_SRC_IP_PROBE:  arp [4650]  Duplicate address Detected. Probe  packet received from 34bd.c8a3.ce30 on Vlan99(port-channel46) with destination set to our local Virtual ip, 10.10.10.1

2013 Oct 25 15:23:35 N7K  %ARP-3-DUP_SRC_IP_PROBE:  arp [4650]  Duplicate address Detected. Probe  packet received from 34bd.c8a3.ce30 on Vlan109(port-channel46) with destination set to our local ip, 10.10.10.2

What is an ARP probe?

An ARP probe is an ARP request constructed with an all-zero sender IP address. The term is used in the IPv4 Address Conflict Detection specification (RFC 5227). Before beginning to use an IPv4 address (whether received from manual configuration, DHCP, or some other means), a host implementing this specification must test to see if the address is already in use, by broadcasting ARP probe packets.[8]

Troubleshooting

These ARP probes are being sent by a Mac address belonging to a switch that does not have an SVI in that Vlan.

Upon further investigation, these are ARP Probe packets sent by IOS devices running  the IP Device Tracking feature.

Here is a sample Ethanalyzer capture of the packet:

N7K# ethanalyzer local interface inband capture-filter "ether src 34:bd:c8:a3:ce:30 and arp and host 10.10.10.2" detail

Capturing on inband

Frame 1 (60 bytes on wire, 60 bytes captured)

Arrival Time: Oct 25, 2013 15:28:59.577664000

[Time delta from previous captured frame: 0.000000000 seconds]

[Time delta from previous displayed frame: 0.000000000 seconds]

[Time since reference or first frame: 0.000000000 seconds]

Frame Number: 1

Frame Length: 60 bytes

Capture Length: 60 bytes

[Frame is marked: False]

[Protocols in frame: eth:arp]

Ethernet II, Src: 34:bd:c8:a3:ce:30 (34:bd:c8:a3:ce:30), Dst: c0:62:6b:ae:03:c1 (c0:62:6b:ae:03:c1)

Destination: c0:62:6b:ae:03:c1 (c0:62:6b:ae:03:c1)

Address: c0:62:6b:ae:03:c1 (c0:62:6b:ae:03:c1)

.... ...0 .... .... .... .... = IG bit: Individual address (unicast)

.... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)

Source: 34:bd:c8:a3:ce:30 (34:bd:c8:a3:ce:30)

Address: 34:bd:c8:a3:ce:30 (34:bd:c8:a3:ce:30)

.... ...0 .... .... .... .... = IG bit: Individual address (unicast)

.... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)

Type: ARP (0x0806)

Trailer: 000000000000000000000000000000000000

Address Resolution Protocol (request)

Hardware type: Ethernet (0x0001)

Protocol type: IP (0x0800)

Hardware size: 6

Protocol size: 4

Opcode: request (0x0001)

[Is gratuitous: False]

Sender MAC address: 34:bd:c8:a3:ce:30 (34:bd:c8:a3:ce:30)

Sender IP address: 0.0.0.0 (0.0.0.0)

Target MAC address: c0:62:6b:ae:03:c1 (c0:62:6b:ae:03:c1)

Target IP address: 10.10.10.2 (10.10.10.2)

Workaround

The IP Device Tracking feature is now enabled by default in some IOS switches

To workaround this you can disable IPDT on the physical interface(s) going to the nexus from these devices:

Note: This cannot be disabled globally, it must be done per interface.  If this is a port-channel you should configure this on the port-channel logical interface, not the physical interfaces.

IOSswitch(config)# no ip device tracking

% IP device tracking is disabled at the interface level by removing the relevant configs

IOSswitch(config)# interface gi1/0/1

IOSswitch(config-if)# ip device tracking maximum 0

IOSswitch(config-if)# end

On the 3850 with 3.2.3SE the below configuration will disable the feature:

3850(config)# interface gi1/0/1

3850(config-if)# ip device tracking maximum 1

3850(config-if)# NMSP attach suppress

3850(config-if)# end

3850# wr mem

On the 3850 with 3.3.3SE the below configuration will disable the feature (ip device tracking max 0 works now):

3850(config)# interface gi1/0/1

3850(config-if)# ip device tracking maximum 0

3850(config-if)# NMSP attach suppress

3850(config-if)# end

3850# wr mem

Reference bugs

CSCud96554    Suppress syslog %ARP-3-DUP_VADDR_SRC_IP_PROBE

CSCul20441   Suppress syslog %ARP-3-DUP_VADDR_SRC_IP_PROBE in 6.2(2)