On 29/07/15 10:56, Ewen McNeill wrote:
[Does anyone know of any software that generates ARP _Requests_ with the Target Protocol Address (TPA) of 255.255.255.255 (all ones). Such that results in this sort of log message from picky switches:
<188> Jul 29 10:47:13 [SWITCH] ARP[ipMapForwarding]: ipmap_arp_api.c(1147) 1021154 %% Received ARP Request on interface Vl1 with bad target IP address 255.255.255.255. Sender IP is [REALIP], sender MAC is [REALMAC].
For the record (eg, someone searching for this later) it turned out that disabling the ZESService (ZENworks Endpoint Security Service) caused these strange ARP messages to stop. It's still unknown why it was causing them, especially since that was running on multiple hosts at the site and only that one host was generating these ARP messages. But since the ZENWorks was due to be removed from that host eventually anyway, the Windows admins just disabled the service now. Jed's theory that there was a bug in the NIC hardware offload driver/firmware may well be related to the real cause of those packets. But we're considering the problem solved, without trying to find all the causative factors. Ewen