Web and Unmanaged
1752810 Members
5838 Online
108789 Solutions
New Discussion юеВ

Re: ARP-storm. 1910-8G

 
SOLVED
Go to solution
Votion
Occasional Contributor

ARP-storm. 1910-8G

Good day. 

 

I really need your help cause I have no idea what it is and how i can fix it.

 

In my network i have about 10 HP Procurve 2510, 2610 and other and 2 HP 1910-8G (192.168.7.238, 192.168.7.239)

 

I have some strange problems with these Hp Procurve 1910-8G. Sometimes (5-10 times in the day) these HP 1910-8G send a lot (10000-15000 packets per second) of unicast ARP packets.  Source - It's my HP 1910, Destination - some computers in my network (which are shut down in this moment). 

 

As I know It's unicast arp poll - "Unicast Poll -- Actively poll the remote host by periodically sending a point-to-point ARP Request to it, and delete the entry if no ARP Reply is received from N successive polls. Again, the timeout should be on the order of a minute, and typically N is 2."

 

Typically.. but no in my situation. Could you explain me this strange behaviour and how can i fix it? 

 

 

Hope for your help. Thanks in advance. 

 

In the attachment - screenshot from the Wireshark in the moment of ARP storm and actually wireshark file *.pcapng

 

1. First HP 1910-8G


Device Name
HP 1910-8G Switch JG348A

 

Product Information
HP 1910-8G Switch Software Version Release 1513

 

Software Version 
5.20 Release 1513

 

 

Hardware Version 
REV.A

 

Bootroom version

158

 

2. Second HP 1910-8G

 

Device Name
HP 1910-8G Switch JG348A

 

 

Product Information
HP 1910-8G Switch Software Version Release 1513P81

 

Software Version 
5.20 Release 1513P81

 

 

Hardware Version 
REV.A

 

Bootroom version

169

 

2 REPLIES 2
Richard Brodie_1
Honored Contributor
Solution

Re: ARP-storm. 1910-8G

The 1910s seem to want to refresh their ARP cache after a topology change. I haven't seen anything like the scale of ARP flooding that you have though: there's no possibility that you have a transitory loop at the same time?

 

I managed to reduce the problem by disabling the gratuitous ARP learning function, which reduced the size of the ARP table.

Votion
Occasional Contributor

Re: ARP-storm. 1910-8G