The ARP packet rate(89pps) exceeded the rate limit (50pps) on interface...

[paulgear]

Hi Michael,

The port in question is the uplink of the switch.  The number of clients behind that port should be in the order of 100-200.  Not necessarily all on the same VLAN.

I'd have to dig into the code to find out about the non-unicast packet counters, but I'd be reasonably confident that it's somewhere in the standard interface MIB.

[C0LDWiR3D]

We have an installation with 5120 that were reporting this as well on the uplink ports (3 in a BAGG) to the CORE switches.

The fix here was to do the right configuration and only allow the VLANs to be used, as someone (lazy) had just done the 'port trunk permit vlan all' :-)

Cheers

[itszasecret]

I came across this discussion when researching the same issue, looks like the "arp rate-limit" was turned on by default in code R2220.  Just thought I'd add this incase anyone is also searching for an answer.  Here is the link to the HP document about this change.

https://h20565.www2.hp.com/portal/site/hpsc/template.PAGE/public/psi/mostViewedDisplay/?javax.portlet.begCacheTok=com.vignette.cachetoken&javax.portlet.endCacheTok=com.vignette.cachetoken&javax.portlet.prp_efb5c0793523e51970c8fa22b053ce01=wsrp-navigationalState%3DdocId%253Dmmr_kc-0103772-8%257CdocLocale%253Den_US&javax.portlet.tpst=efb5c0793523e51970c8fa22b053ce01&sp4ts.oid=4199654&ac.admitted=139...

[ciobis]

Hi,

I am having the same issue on a HP A5800-24G-SFP running Comware Software, Version 5.20.105.

I see these messages on all the uplink BAGG interfaces on this particular switch:

%%10ARP/4/ARPRateOverSpeed(t): -Slot=2;   1.3.6.1.4.1.25506.2.110.1.1.0.1: The ARP packet rate execeeds the rate limit.

%%10ARP/4/RATELIMIT(l): -Slot=2; The ARP packet rate(101pps) exceeded the rate limit(100pps) on interface GigabitEthernet2/0/2 in the last 60 seconds.

What is interesting is that this is not happening all the time, but it seems like almost everytime when a BAGG is decomissioned or created on any switch in the Datacenter that is not necessarly directty connected to this particular one.

The order of events seems to like this:

BAGG created or dicomisisoned

Topology Change sent out, every switch, including this troubling one recieves it

ARP packet rate on the troubling switch, on uplinks (this switch is only connected to other switches) show up in syslog

[Richard Brodie_1]

I have found Comware switches themselves some of the worst offenders in sending ARPs. On topology change, they seem to want to refresh their entire ARP cache.

[ciobis]

is there anyway this can be fixed?

[Apachez-]

Either you can alter the default value of 400 to something different (default was raised from 50 to 400 in R2221) through:

arp rate-limit xxx

Or you can just disable logging when arp rate-limit is violated:

info-center source ARP channel 4 log level errors

undo snmp-agent trap enable arp rate-limit

Look here for more info: http://comaware.wordpress.com/2013/12/13/arp-ratelimit-spamming-logbuffer/

[ciobis]

it's  interesting the these message is dislayed for BAGG that have a status of DOWN. How can the ARP rate-limit exceed on a down interface?

[Apachez-]

Are the members who belongs to this BAGG down aswell?

[ciobis]

That BAGG does not even have interfaces associated to it;  there is just the configuration of the interface left, as somebody probably forgot to clean up:

dis link-aggregation verbose Bridge-Aggregation 20
Loadsharing Type: Shar -- Loadsharing, NonS -- Non-Loadsharing
Port Status: S -- Selected, U -- Unselected
Flags: A -- LACP_Activity, B -- LACP_Timeout, C -- Aggregation,
D -- Synchronization, E -- Collecting, F -- Distributing,
G -- Defaulted, H -- Expired

Aggregation Interface: Bridge-Aggregation20
Aggregation Mode: Static
Loadsharing Type: Shar
Port Status Priority Oper-Key
--------------------------------------------------------------------------------

Also, is it normal that after a stp topology change, the switches refresh their ARP cache? this is what I noticed during some testing; i have added a new switch into the network, topology change was generated, switches refreshed their cache, and the "The ARP packet rate(89pps) exceeded the rate limit (100pps) on interface"  was filling the logs on these two particular switches we usually get these messages.