This is a static archive of our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

Duplicate Ip - Gratuitous ARP

0

I am using six cisco network switches in my network. While analyzing network traffic using Wireshark, i found errors like Ip Duplication- Gratuitous ARP. So can anyone tell me how these errors are effecting in behavior of my network using IO graph and TCP stream graph, as i am new to wireshark. I am attaching the capture file. https://drive.google.com/file/d/0B8asXfpLSWu5YWh5OUtSN0t5eGM/view?usp=sharing

asked 21 Feb '15, 16:18

mohdaftab93's gravatar image

mohdaftab93
6335
accept rate: 0%


One Answer:

0

These Gratuitous ARPs are a sign for an IP address "collision", meaning use of the IP address 192.168.1.254 on the devices answering with Gratuitous ARPs to a dedicated MAC (not the broadcast address).

That's most certainly because your are using Cisco Small Business Switches (SG300) and they all have 192.168.1.254 as the default management IP address.

So, to answer your question: No, those ARP messages won't interfere with your network! However you should assign every switch its own address, if you want to manage them and/or if you want to get rid of those ARPs.

Regards
Kurt

answered 23 Feb '15, 05:38

Kurt%20Knochner's gravatar image

Kurt Knochner ♦
24.8k1039237
accept rate: 15%