D-Link Forums

The Graveyard - Products No Longer Supported => D-Link NetDefend Firewalls => Topic started by: iverona on November 03, 2011, 05:39:51 AM

Title: arp_resolution_failed/remove_entry [SOLVED]
Post by: iverona on November 03, 2011, 05:39:51 AM
Hi all!

I've a DFL-800 (with firmware version 2.27.03.25-14780) running on my net, and I few days ago I noticed that I've this message on the logs, almost every 10 seconds, and it's annoying:

2011-11-03 13:34:30     Warning     ARP 300009             arp_resolution_failed remove_entry
ipaddr=192.168.1.12 iface=lan

And the same with IP 192.168.1.11. The strange thing here is that I don't have those IPs on my network, and I've no idea where this ARP entry is coming from. Where can I get more information about this problem? On the CLI, I see:

Code: [Select]
DFL-800:/> arp -show lan
ARP cache of iface lan
  Reslvng 192.168.1.11     = 00-00-00-00-00-00   Expire=1
  Reslvng 192.168.1.12     = 00-00-00-00-00-00   Expire=1

and after a few seconds it disappears, and appears again... I'm just curious about where is the problem :) I'm trying to connect *anything* with .11/.12 IPs just to check if the problem is solved.

Thakns in advance!
Title: Re: arp_resolution_failed/remove_entry
Post by: danilovav on November 03, 2011, 07:20:05 PM
Check your routes, IP rules, ARP table, misc. settings like syslog, mail, DNS - probably, in somewhere this IP is used

In my case, i've used 1.11 as second IP

Code: [Select]
ARP cache of iface lan
  Dynamic 192.168.10.146   = 28-e0-2c-40-3b-##   Expire=372
  Dynamic 192.168.10.52    = 00-0c-29-d4-8f-##   Expire=340
  Dynamic 192.168.10.54    = 00-0c-29-58-05-##   Expire=216
  Dynamic 192.168.10.48    = 00-18-ba-c4-d0-##   Expire=371
  Dynamic 192.168.10.50    = 70-71-bc-7b-7a-##   Expire=350
  Dynamic 192.168.10.18    = 00-0c-29-40-38-##   Expire=59
  Dynamic 192.168.10.13    = 00-a2-f2-cf-00-##   Expire=210
  Dynamic 192.168.10.10    = f0-7d-68-b1-68-##   Expire=897
  PUBLISH 192.168.10.2     = 00-00-00-00-00-##
  Dynamic 192.168.10.122   = 00-24-54-d2-03-##   Expire=746
  Dynamic 192.168.10.99    = 00-11-32-05-78-##   Expire=341
  PUBLISH 192.168.1.11     = 00-00-00-00-00-00

Home-800:/> show ARP

   #  Mode     Interface  IP                           MAC address
   -  -------  ---------  ---------------------------  -----------------
   1  Publish  lan        InterfaceAddresses/lan_1_ip  00-00-00-00-00-00
   2  Publish  lan        InterfaceAddresses/lan_ip2   00-00-00-00-00-00
   3  Publish  dmz        InterfaceAddresses/dmz_ip2   00-00-00-00-00-00

Home-800:/> show Address IP4Address InterfaceAddresses/lan_1_ip

              Property  Value
 ---------------------  ------------
                 Name:  lan_1_ip
              Address:  192.168.1.11
       UserAuthGroups:  <empty>
 NoDefinedCredentials:  No
             Comments:  <empty>
Title: Re: arp_resolution_failed/remove_entry
Post by: iverona on June 28, 2012, 12:50:14 AM
Hi danilovav,

more than 6 months after your reply I've had time to track this issue. It was one of the laptops of my users continuously looking for three old printers that are not anymore present. It was sending SNMP messages every 10 seconds, and now it's solved :-)

Thanks for your help!!