HPE Community read-only access December 15, 2018
This is a maintenance upgrade. You will be able to read articles and posts, but not post or reply.
Hours:
Dec 15, 4:00 am to 10:00 am UTC
Dec 14, 10:00 pm CST to Dec 15, 4:00 am CST
Dec 14, 8:00 pm PST to Dec 15, 2:00 am PST
Web and Unmanaged
cancel
Showing results for 
Search instead for 
Did you mean: 

ARP-storm. 1910-8G

 
SOLVED
Go to solution
Votion
Occasional Contributor

ARP-storm. 1910-8G

Good day. 

 

I really need your help cause I have no idea what it is and how i can fix it.

 

In my network i have about 10 HP Procurve 2510, 2610 and other and 2 HP 1910-8G (192.168.7.238, 192.168.7.239)

 

I have some strange problems with these Hp Procurve 1910-8G. Sometimes (5-10 times in the day) these HP 1910-8G send a lot (10000-15000 packets per second) of unicast ARP packets.  Source - It's my HP 1910, Destination - some computers in my network (which are shut down in this moment). 

 

As I know It's unicast arp poll - "Unicast Poll -- Actively poll the remote host by periodically sending a point-to-point ARP Request to it, and delete the entry if no ARP Reply is received from N successive polls. Again, the timeout should be on the order of a minute, and typically N is 2."

 

Typically.. but no in my situation. Could you explain me this strange behaviour and how can i fix it? 

 

 

Hope for your help. Thanks in advance. 

 

In the attachment - screenshot from the Wireshark in the moment of ARP storm and actually wireshark file *.pcapng

 

1. First HP 1910-8G


Device Name
HP 1910-8G Switch JG348A

 

Product Information
HP 1910-8G Switch Software Version Release 1513

 

Software Version 
5.20 Release 1513

 

 

Hardware Version 
REV.A

 

Bootroom version

158

 

2. Second HP 1910-8G

 

Device Name
HP 1910-8G Switch JG348A

 

 

Product Information
HP 1910-8G Switch Software Version Release 1513P81

 

Software Version 
5.20 Release 1513P81

 

 

Hardware Version 
REV.A

 

Bootroom version

169

 

2 REPLIES
Richard Brodie_1
Honored Contributor
Solution

Re: ARP-storm. 1910-8G

The 1910s seem to want to refresh their ARP cache after a topology change. I haven't seen anything like the scale of ARP flooding that you have though: there's no possibility that you have a transitory loop at the same time?

 

I managed to reduce the problem by disabling the gratuitous ARP learning function, which reduced the size of the ARP table.

Votion
Occasional Contributor

Re: ARP-storm. 1910-8G