ARP cache poisoning detection disabled

I recently checked all the messages in the console and found the following error message: Could not enable ARP cache poisoning detection. Your computer will not be protected. This message is logged every time I turn on the computer. I am assuming this problem started when I upgraded to Mac OS 10.5.6 since I have never seen this message before and it does not appear on my other machine that is still on Mac OS 10.5.5. Is anyone else getting this message?? Is there any way to resolve this issue so that my computer will be protected? Is Apple aware of this problem and is perhaps working on a fix??

Do a google search for *'ARP cache poisoning detection'* and read the various hits.

Similar Messages

Kernal message: Could not enable ARP cache poisoning detection.

Looking at system files in Console, for another issue, I came across this kernal message, which occurs at start-up: "*Could not enable ARP cache poisoning detection. Your computer will not be protected*."
It's an intel Mac Mini running Leopard ( 10.5.8 ). I have Norton Antivirus for Mac 11 installed (I know, I know), which has ARP cache poisoning turned on in its "vulnerability protection" prefs. I've gotten no warnings of attacks from Norton, just this Kernal message at start-up. I've seen this issue on a couple of other threads with no answer or solution (except advice to Google it... duh!), already archived and accepting no new posts... so no help there.
Is this ARP cache poisoning detection part of the OS, and if so, why is it not being enabled? Is there a way to enable it? Could the kernal message be telling me that the Norton protection is bugged and not working, or would it be OS related. The mini is a wired connection (ethernet), and there's one other laptop (macbook 10.4.11) using the modem/router ( Actiontec GT 701-wg) via wireless airport. I haven't seen this message on the laptop in console or system logs, but haven't looked hard.
Someone, please respond with a knowledgeable answer, for me and for others who've asked here and on other forums with no helpful public answers given.

Doing a "erase and install" of Leopard, thus dumping Norton AV 11, and then installing Snow Leopard... I haven't seen this Kernal message come up again, yet. I'll assume it was some buggy Norton related thing that cropped up after an OS update, but who knows. I'll leave the question open for a bit, in case anyone else has had this issue and found a reason or solution, and wants to share.

ARP cache poisoning error

Hi all,
I've googled and searched these discussions, but I can't find any pertinent info on this topic, so here's my question...
While looking into another issue, I noticed that my system.log had logged an error that concerned me:
*"Aug 4 12:03:52 localhost kernel[0]: Could not enable ARP cache poisoning detection. Your computer will not be protected."*
This message appears to only be logged on startup, and has been logged numerous times.
Does anyone know why this protection is disabled, and how I can re-enable it, if that's even possible (or necessary)?
Thanks!

Do a google search for *'ARP cache poisoning detection'* and read the various hits.

ARP cache poison

i hope that this is the correct forum, apologies if it is not.
I constantly get a Norton "vulnerability blocked" notification because of ARP cache poison. I am assuming that this is a function of my OS, if not I will contact Symantec. Does anyone know how to get rid of this annoyance short of disabling Norton?

Remove Norton. It's a known troublemaker on Macs and there's very little for it to find - no viruses and only a few easy-to-avoid trojans. See my [Mac Virus guide|http://www.reedcorner.net/thomas/guides/macvirus> for more information.
If you're worried about your security on the network against hackers, make sure your machine is hidden behind a router. If you're using a wireless network, you're already hidden behind a router, but make sure you're using WPA encryption on that network with a good password.

ARP Cache Poison behavior by Apple TV

Norton Anti-Virus reports blocking an ARP Cache Poison attack against my home network. The reported source of the attack is the MAC number of the Apple TV on the network.
Whether Norton is "reliable" is apparently contentious in the support community. Several authors suggest, with authority, disabling Norton or the particular attack profile.
Whether that makes sense depends on what the Apple TV is innocently doing to be profiled as a network attack.
Even when supposedly "asleep" the Apple TV is doing something that meets the profile of an ARP Cache Poison attack. It did it every 30 minutes today, nine times yesterday, about 30 times day before and etc.
And if it is a design feature of the device, why is the device still performing despite having the activity continously blocked? What is the purpose of this attack-like activity, assuming it is not an attack? If it is an attack, how does one erase the programming initiating the attacks and still have an Apple TV?

Short answer: it is a false positive. I don't know exactly what causes it but I would guess Apple's Bonjour protocol, which is why you see something every 30 minutes. That's just a blind guess, but seems to fit.
Realize that a report of ARP poisoning wouldn't be likely on a private LAN, unless you got infected somehow. No known malware like this for iOS devices (and much harder to insert one on AppleTV versus an iPhone or iPad.) There are legitimate cases where ARP spoofing is used. And even Cisco has instances where they say to ignore that warning:
CSCsm25943—The meaning of the following error message on the controller is not clear. This message does not necessarily imply that any actual "ARP poisoning" is occurring. Rather, this message appears when a WLAN is configured for DHCP Required and a client (after associating to this WLAN) transmits an ARP message without first using DHCP. The client is unable to send or receive any data traffic until it performs DHCP through the controller.
DTL-1-ARP_POISON_DETECTED: STA [00:01:02:0e:54:c4, 0.0.0.0] ARP (op 1) received with
invalid SPA 192.168.1.152/TPA 192.168.0.206
Workaround: Perform the following steps:
• Verify that the client eventually does perform DHCP without undergoing an unacceptable outage. If the outage before performing DHCP is acceptable, then you can ignore this message.
I'm not saying that Norton's message is the same as Cisco's. Just that Cisco states that the meaning of why the message appears is not clear and sometimes is acceptable. And Cisco is the world leader in networking technology so if they don't always know why you get an ARP poisoning warning....
I won't go into the politics of "Norton bad" or whatever, but based on my experience (bias) with Norton in it's various forms for over 10 years, IMHO you can ignore this. Hopefully you can configure Norton to selectively ignore this. If not, you may have to use a different security program. Me personally, I do not recommend any "security suites" because they cause exactly this kind of additional headache. Just a "plain" antivirus program. Windows has a built-in firewall and most people will be using a hardware firewall at the office or home so the firewall in the "security suite" is extraneous.

ARP Cache Poison reported in Norton AntiVirus for Mac

The MAC address from my new gen Apple TV is being tagged from Norton Antivirus as sending an ARP Cache Poison. Anything to care about, folks?

DNS cache poisoning affects certain versions of named and is used by miscreants to redirect access requests to sites they control. It's likely that the warning you're receiving is a false alarm, but it could be valid if either your computer or your ATV has been compromised.
Check Norton's web site or contact their technical support to be sure. It's not a warning I would simply ignore, as it would indicate a serious security breach if it's valid.

ARP cache

Hi !
My MacBook (466) kernel said (console):
"could not enable ARP cache poisoning detection..."
Do you know what the reason is and how to solve it ?
Best regards;
lachala

No it isn't the same and each are cleared independently. The arp cache is a layer3 database and used for a completely different purpose than the mac-address-table albeit complimentary. The arp cache provides the sending ip host with the mac address of the destination host and the sender builds the l2 frame with this info. Then when the frame gets to the switch, the switch benefits by having the mac address in the mac-address-table table so that it knows which specif port to forward the frame to instead of sending it out all ports the way a hub would.
HTH pls rate!

Force mapping to a specific MAC address a multicast IP address in ARP cache table with netsh

Hi all,
I would like to know if there is any solution (netsh option, registry entry, whatever...) to force mapping a given MAC address to a multicast IP address (224.x.y.z) in my ARP cache table.
I am doing the following:
netsh.exe interface ip add neighbors "Ethernet" "224.224.xxx.yyy"
"00-80-EE-UU-VV-WW"
But the entry in the ARP table is substitued by the calculated multicast MAC@ corresponding to my multicast IP@ :
netsh.exe interface ip show neighbors "Ethernet"
Interface 12 : Ethernet
Internet Address
Physical Address Type
224.0.0.22
01-00-5e-XX-YY-ZZ
static
224.224.yyy.zzz
01-00-5e-UU-VV-WW
static
(For information, calculation of the Multicast MAC Address is described in RFC1112§6.4 -> The MAC@ equals 01-00-5e + the last 23 digits of the multicast MAC Address)
My problem is that I'm not using an Ethernet network but an AFDX (used on Airbus A380, Boeing 787 Dreamliner, by the NASA...). This network topology is a deterministic Ethernet. The network must know accurately where each network packet is going. Thus...
the multicast MAC@ cannot be accepted and packet destinated to that MAC@ are not going anywhere.
So, I must match accurately my multicast IP@ to my MAC@ (00-80...).
It used to work with Windows XP (which was not doing any "magical" MAC@ substitution on multicast IP@), but since Windows Vista, netsh is doing the substitution described above. Is there any way to disable this substitution or force my IP
to MAC mapping in ARP table? And of course, I'm not using XP anymore ;)... but a tablet with Windows 8.1.
Thanks for any help.
Cheers,
Olivier.

Hi,
The article you pointed me to is just an explanation of what I said in my original post : "Multicast MAC Address is described in RFC1112§6.4".
But, as I said in my original post, this is true ONLY for Ethernet network. And I am NOT on an Ethernet network.
So MAC address automatic calculation for my IP address done by Windows/netsh/arp is wrong in my case. The calculation Windows is doing is correct ONLY for Ethernet network. Since I am not on Ethernet, I don't want these calculations, and I'm looking for
a solution to disable them.
So, the underlying question is : "Is Microsoft/netsh/arp able to handle other network's type than Ethernet ?"
Thanks,
Olivier Dupré.

ARP cache error

We have a SBS 2003 server running with a standard dual network configuration. One card for accessing the internet and the other card to connect the server to the local network.
We frequently lose our internet connection for an unknown reason (although the other card is fine and all client computers are still able to access the server -- they just loose internet access.)
We also receive the 'Clearing the ARP Cache' error message when trying to repair the connection.
However, instead of rebooting the server, we simply go into the Network Connections, locate the card that is for the internet connection, right-click and choose 'Disable', and then after it is disabled, right-click and choose 'Enable'.

Hi,
Before going further, would you please let me know if you have configured RRAS on your server? Based on your description, the problem can be caused if you are using RRAS as your basic firewall/NAT.
Please try the following suggestions to see if the problem can be resolved.
1. Firstly, we should make sure whether the network setting is correctly and properly configured. Please re-run CEICW Wizard on the SBS Server, it helps us automatically configure the network
settings, you can refer to this step-by-step article to finish the wizard:
How to configure Internet access in Windows Small Business Server 2003
http://support.microsoft.com/kb/825763/en-us
2. Please double check if you have correctly configured your DNS settings.
a. Leave the Default Gateway of the internal NIC blank on the SBS Server.
b. Configure both the internal NIC and the external NIC to use the internal DNS Service as the DNS Server.
c. On the DNS Server, create the DNS Forwarder to forward the external DNS resolution requests to the ISP's DNS
d. On the DNS Server, delete any public IP that is being registered in the local DNS.
3. Type "arp -d *" (without the quotation mark) from the command prompt. Then try repairing the network card again. If error still occurs, please turn to step 4.
4. Try turning off the "Routing and Remote Access" service, it can cause this problem.
a. Click Start->Run, type "services.msc", go and find "Routing & Remote Access", right click it and choose Properties.
b. Set start-up type to disabled and stop the service.
c. Then restart the computer which is mandatory in this case.
d. Try repairing the network card again, any luck?
If the problem persists, please help me gather the following information:
1. Does everything work normally before? If so, what changes have you made to the server/clients before the problem occurred?
2. Make sure that you uncheck "register this connections in DNS" check box from external NIC.
3. Confirm the connection binding order.
a. Please open Control Panel -> network connections.
b. Click Advanced -> Advanced settings
c. In the adapters and bindings tab, make sure that the internal adapter is on the top.
For your information:
A Description of the Repair Option on a Local Area Network or High-Speed Internet Connection
https://support.microsoft.com/kb/289256/en-us
Hope it helps.
Best Regards,
Andy Qi
Andy Qi
TechNet Community Support

IPMP / ARP Cache oddity - Solaris to Windows comm errors

First - a qualification - I'm not an Solaris admin, so feel free to call me out for any blatant errors..
I've got several Solaris 10 servers that are having intermittent network communication issues with Windows 2003 servers on the same subnet. All Solaris boxes are using two NICs and IPMP for their connections to the "primary" network. For example, one server (hostname bugbear) has two adapters ce0 and ce9:
# ifconfig -a
ce0: flags=1000843<UP,BROADCAST,RUNNING,MULTICAST,IPv4> mtu 1500 index 2
        inet 16.106.64.227 netmask fffff800 broadcast 16.106.71.255
        groupname shared0
ce9: flags=1000843<UP,BROADCAST,RUNNING,MULTICAST,IPv4> mtu 1500 index 4
        inet 0.0.0.0 netmask ff000000 broadcast 0.255.255.255
        groupname shared0
# cat /etc/hostname.ce0
bugbear netmask + broadcast + group shared0 up
# cat /etc/hostname.ce9
group shared0 upIf I look at the arp cache, (almost) every other server it talks to shows up twice - an entry for each of the NIC devices:
# arp -a
Net to Media Table: IPv4
Device   IP Address               Mask      Flags      Phys Addr
ce9    win2k3box.city.acme.com 255.255.255.255 o        00:50:56:ae:13:58
ce0    win2k3box.city.acme.com 255.255.255.255 o        00:50:56:ae:13:58I guess that's as expected - again, I'm not a Solaris expert.
Finally, here's the issue I've found. For any other UNIX/Solaris hosts listed in the arp cache, my server can ping/FTP/whatever to the other - no problem. Sometimes the ce0 interface is listed first in the output for the target server, sometimes the ce9 interface is listed first. Doesn't matter - my server can talk to the other just fine.
HOWEVER - for Windows servers, the order of entry in the arp cache seems to have relevance. If the ce9 interface is listed first, I can't ping, can't FTP, can't connect to the other server. If the ce0 interface is listed first, then everything works fine.
Eventually the arp cache entries age out and get deleted. Usually then my server can talk to the Windows server again. I also found that if I delete both arp cache entries for the target Windows server, my server can talk to it again (arp cache gets rebuilt with the ce0 interface). If left alone, the behavior seems to be that my server can talk to a Windows target for an hour or two, then it can't for another hour or two, then the cycle repeats.
NOTE - The mac address in the arp cache is not getting poisoned, as with the Broadcom windows driver issue that hit some folks (myself included). All the mac addresses for the servers in the arp cache are consistent as best I can tell, so that's not the problem.
Any input/suggestions greatly appreciated.

Here are the codes:
In the initializing stage,
     try {
          this.serialPort = (SerialPort) portId.open("SimpleReadApp", 2000);
     } catch (PortInUseException e) {
         e.printStackTrace();
     this.serialPort.notifyOnDataAvailable(false);
     try {
        this.serialPort.setSerialPortParams(9600, SerialPort.DATABITS_8, SerialPort.STOPBITS_1, SerialPort.PARITY_NONE);
        this.serialPort.setFlowControlMode(SerialPort.FLOWCONTROL_NONE);
        this.serialPort.enableReceiveTimeout(10);
//this.serialPort.disableReceiveTimeout();
//this.serialPort.enableReceiveThreshold(0);
        this.serialPort.enableReceiveThreshold(1*1024*1024);
        if (this.serialPort.getInputStream() != null)
                this.inputStream = this.serialPort.getInputStream();
        else
                System.out.print("can not get inpustream!\n");
      } catch (Exception e) {
              e.printStackTrace();
      }Then in the reading stage, we have:
    byte[] readBuffer = new byte[1 * 1024 * 10];
    while (true) {
          try {
               int numBytes = inputStream.read(readBuffer);
               System.out.print("There are " + numBytes + " bytes having been read.");
          } catch (Exception e) {
              e.printStackTrace();
          }The above codes do not have any problem using COMM API 2.0 on Windows. Or COMM API 3.0 on Solaris. But, on RedHat, it can run out of memory very quickly.
Edited by: EJP on 13/05/2011 11:27: added { code } tags. Please use them.

IP-4-ZERO_ADDR: Zero MAC address for ip in ARP cache

Could someone hlep me with this log message: IP-4-ZERO_ADDR: Zero MAC address for <ip> in ARP cache
It just started appearing in our Cisco 10012 CMTS, and all of the documentation is very vague as to what it is and how to fix it. I'm hoping someone else has seen the message and can help clarify it's meaning. Thanks in advance!

Your not the only one with these logs mess :
Jan 20 13:05:10: %IP-4-ZERO_ADDR: Zero MAC address for 10.100.xxx.69 in ARP cache
Jan 20 13:30:02: %IP-4-ZERO_ADDR: Zero MAC address for 10.100.xxx.69 in ARP cache
I thing the reason is that someone has a worm or something ping-flooding/scanning the network, check your arp table for incompletes.
What to do about it, disable icmp on the network maybe, for now we dont have a problem on the network but would be nice to fix this thing.
Martin
DK

DNS Cache Poisoning Signature

Is there a signature available for the new Bind 9 DNS Cache Poisoning vulnerability/exploit.
See reference
http://www.securityfocus.com/bid/25037/info

From our research on the subject, we do not believe a high-fidelity signature can be created to detect this attack. The nature of the traffic used in the attack is legitimate and as a successful attack requires some guess-work and timing, there are too many variables to detect any sort of pattern in the traffic used. The initial part of the attack occurs when a user accesses a malicious link. Standard user training should mitigate this vector if users avoid accessing unsolicited links. Updates are also available to patch systems. For more information, please see Intellishield alert number 13831:
https://intellishield.cisco.com/security/alertmanager/basicSearch.do?dispatch=1&UID=13831
We will continue to monitor the situation regarding this vulnerability and take appropriate action when necessary.

Clear arp-cache to ping

I have an SMS server on my network that is unreachable from vlans other that its own. This happened after we pushed out tumbleweed via SMS. Now, in order to ping the server I must issue a clear arp-cache in the core switch, this only last for about 1 min and then the SMS server is unreachable again. Any help would be great.

Thanks Dabels,
I have had this problem as well, it turned out to be a pix.
Proxy-arp is enabled by default on all interfaces and its not apparent in the config when its on or off. Its configured as a sysopt and therefore, it often gets overlooked.
Agree with everything you say, check the mac in the arp table of the server when your pings are failing, then trace the MAC you find there which corresponds to the ip address of the router.
Or check the arp entry in the router (again when its failing) and verify the MAC is the SMS server, it may just turn out to be a router or a pix or even....another server which is routing between a pair of NIC's, such as a unix box or a windows server.
Let us know how you get on.
Cheers
Shaun

What is a ARP cache and how do I clear this cache?

Each time I try to repair my internet connection it states, "unable to complete the repair because it was unable to clear the ARP cache. I do not know or am unable to find in any help file where or what this cache is. Assistance with this would be appreciated greatly. thank you

See:
* http://www.mydigitallife.info/2007/06/20/clear-delete-and-refresh-arp-cache-entry/

Cat c6509 E with Supervisor vs-s720-10g reload and Cache error detected!

Can you help me Cat c6509-E reload
connect console I see :
Initializing ATA monitor library...
Self extracting the image... [OK]
Self decompressing the image : ############################# [OK]
Restricted Rights Legend
Use, duplication, or disclosure by the Government is
subject to restrictions as set forth in subparagraph
(c) of the Commercial Computer Software - Restricted
Rights clause at FAR sec. 52.227-19 and subparagraph
(c) (1) (ii) of the Rights in Technical Data and Computer
Software clause at DFARS sec. 252.227-7013.
cisco Systems, Inc.
170 West Tasman Drive
San Jose, California 95134-1706
Cisco IOS Software, s72033_sp Software (s72033_sp-IPBASEK9-M), Version 12.2(33)SXI1, RELEASE SOFTWARE (fc3)
Technical Support: http://www.cisco.com/techsupport
Copyright (c) 1986-2009 by Cisco Systems, Inc.
Compiled Sat 28-Mar-09 10:48 by prod_rel_team
Image text-base: 0x40101328, data-base: 0x421FFA10
Cache error detected!
CPO_ECC (reg 26/0): 0x000000B6
CPO_CACHERI (reg 27/0): 0x84000000
CP0_CAUSE (reg 13/0): 0x00004800
Real cache error detected. System will be halted.
Error: Primary data cache, fields: , 1st dword
Actual physical addr 0x00000000,
virtual address is imprecise.
Imprecise Data Parity Error
Imprecise Data Parity Error
22:12:30 UTC Tue Mar 24 2015: Interrupt exception, CPU signal 20, PC = 0x413EB310
Possible software fault. Upon reccurence, please collect
crashinfo, "show tech" and contact Cisco Technical Support.
-Traceback= 414EDA90
$0 : 00000000, AT : 42510000, v0 : 00000000, v1 : 00000001
a0 : 43757CC4, a1 : 00040110, a2 : 45762ECE, a3 : 00000000
t0 : 44997CF0, t1 : 00000000, t2 : D5303A40, t3 : 00003A40
t4 : 0000004F, t5 : 0000005F, t6 : 68C8F600, t7 : 00000000
s0 : BEDA4010, s1 : 00000000, s2 : 00000000, s3 : 44086D60
s4 : 45762ECC, s5 : 00000001, s6 : 00000080, s7 : 44080000
t8 : 45762ECC, t9 : 00000000, k0 : 841E6970, k1 : 02951800
gp : 4250FC60, sp : 44997D48, s8 : 4499848E, ra : 413EB310
EPC : 414EDA90, ErrorEPC : 413EB310, SREG : 3400F105
MDLO : 00159DC0, MDHI : 00000000, BadVaddr : 00000000
DATA_START : 0x421FFA10
Cause 00004800 (Code 0x0): Interrupt exception
File bootflash:crashinfo_20150324-221230 Device Error :No such device
%Software-forced reload
22:12:30 UTC Tue Mar 24 2015: Breakpoint exception, CPU signal 23, PC = 0x4171F5E0
Possible software fault. Upon reccurence, please collect
crashinfo, "show tech" and contact Cisco Technical Support.
-Traceback= 4171F5E0 4171D184 40F4F26C 40F4F450 40F4F670 4171282C
$0 : 00000000, AT : 42510000, v0 : 441D0000, v1 : 424C0000
a0 : 00000000, a1 : 00008100, a2 : 00000000, a3 : 00000000
t0 : 0000FF00, t1 : 3401FF01, t2 : 41712918, t3 : FFFF00FF
t4 : 41712918, t5 : 73206265, t6 : 65746563, t7 : 20546865
s0 : 00000000, s1 : 424C0000, s2 : 00000000, s3 : 08000000
s4 : 42380000, s5 : 42380000, s6 : 41D90000, s7 : 00000001
t8 : 506D5CC4, t9 : 00000000, k0 : 00000000, k1 : 00000000
gp : 4250FC60, sp : 50012420, s8 : 41D90000, ra : 4171D184
EPC : 4171F5E0, ErrorEPC : 413EB310, SREG : 3401FF03
MDLO : 00000000, MDHI : 00000003, BadVaddr : 00000000
DATA_START : 0x421FFA10
Cause 00000024 (Code 0x9): Breakpoint exception
=== Flushing messages (22:12:30 UTC Tue Mar 24 2015) ===
Buffered messages:
Queued messages:
*Mar 24 22:12:30.695: %SYS-3-LOGGER_FLUSHING: System pausing to ensure console debugging output.
Firmware compiled 19-Feb-09 20:18 by weizhan Build [100]
*Mar 24 22:12:30.667: %SYSTEM_CONTROLLER-3-INFO1: Error address Lo=0x4010
*Mar 24 22:12:30.667: %SYSTEM_CONTROLLER-3-INFO1: Error address Hi=0x1EDA
*Mar 24 22:12:30.667: %SYSTEM_CONTROLLER-3-INFO1: Interrupt Hi reg=0x0
*Mar 24 22:12:30.667: %SYSTEM_CONTROLLER-3-INFO1: Interrupt lo reg=0x8000000
*Mar 24 22:12:30.667: %SYSTEM_CONTROLLER-3-DUMP: System controller Global Registers Dump
*Mar 24 22:12:30.667: %SYSTEM_CONTROLLER-3-INFO1: global hazard reg=0x0
*Mar 24 22:12:30.667: %SYSTEM_CONTROLLER-3-INFO1: soft reset cfg reg=0x10FFFF
*Mar 24 22:12:30.667: %SYSTEM_CONTROLLER-3-INFO1: global cfg reg=0x20
*Mar 24 22:12:30.667: %SYSTEM_CONTROLLER-3-INFO1: init status reg=0x8
*Mar 24 22:12:30.667: %SYSTEM_CONTROLLER-3-INFO1: ibl cfg reg=0xE
*Mar 24 22:12:30.667: %SYSTEM_CONTROLLER-3-INFO1: prio map cfg reg=0x0
*Mar 24 22:12:30.667: %SYSTEM_CONTROLLER-3-INFO1: ecc error log reg=0x0
*Mar 24 22:12:30.667: %SYSTEM_CONTROLLER-3-INFO1: parity error log reg=0x0
*Mar 24 22:12:30.667: %SYSTEM_CONTROLLER-3-INFO1: jtag idcode reg=0x5013102F
*Mar 24 22:12:30.667: %SYSTEM_CONTROLLER-3-INFO1: work status reg hi=0x0
*Mar 24 22:12:30.667: %SYSTEM_CONTROLLER-3-INFO1: work status reg lo=0x0
*Mar 24 22:12:30.667: %SYSTEM_CONTROLLER-3-INFO1: eobc rxstat reg=0x11FE
*Mar 24 22:12:30.667: %SYSTEM_CONTROLLER-3-INFO1: eobc txstat reg=0x0
*Mar 24 22:12:30.667: %SYSTEM_CONTROLLER-3-INFO1: eobc mac cfg reg=0xE24
*Mar 24 22:12:30.667: %SYSTEM_CONTROLLER-3-INFO1: inbound rxstat reg=0x0
*Mar 24 22:12:30.667: %SYSTEM_CONTROLLER-3-INFO1: inbound txstat reg=0x0
*Mar 24 22:12:30.667: %SYSTEM_CONTROLLER-3-INFO1: io int stat reg=0x408
*Mar 24 22:12:30.667: %SYSTEM_CONTROLLER-3-INFO1: pcmcia cfg reg=0x1A0
*Mar 24 22:12:30.667: %SYSTEM_CONTROLLER-3-INFO1: pcmcia stat reg=0x3C
*Mar 24 22:12:30.667: %SYSTEM_CONTROLLER-3-INFO1: bist go stat reg=0x0
*Mar 24 22:12:30.667: %SYSTEM_CONTROLLER-3-INFO1: bist done stat reg=0x0
*Mar 24 22:12:30.667: %SYSTEM_CONTROLLER-3-INFO1: ibl debug reg 0=0x0
*Mar 24 22:12:30.667: %SYSTEM_CONTROLLER-3-INFO1: ibl debug reg 1=0x0
*Mar 24 22:12:30.667: %SYSTEM_CONTROLLER-3-INFO1: ibl debug reg 2=0x0
*Mar 24 22:12:30.667: %SYSTEM_CONTROLLER-3-INFO1: obl debug reg 0=0x0
*Mar 24 22:12:30.667: %SYSTEM_CONTROLLER-3-INFO1: obl debug reg 1=0x0
*Mar 24 22:12:30.667: %SYSTEM_CONTROLLER-3-INFO1: rxq debug reg=0x0
*Mar 24 22:12:30.667: %SYSTEM_CONTROLLER-3-INFO1: txq debug reg=0x0
*Mar 24 22:12:30.667: %SYSTEM_CONTROLLER-3-INFO1: gigmac cfg reg=0x1001
*Mar 24 22:12:30.667: %SYSTEM_CONTROLLER-3-INFO1: gigmac stat reg=0x0
*Mar 24 22:12:30.667: %SYSTEM_CONTROLLER-3-FATAL: An unrecoverable error has been detected. The system is being reset.
*Mar 24 22:12:30.695: %SYS-3-LOGGER_FLUSHING: System pausing to ensure console debugging output.
*Mar 24 22:12:30.695: %SYS-3-LOGGER_FLUSHED: System was paused for 00:00:00 to ensure console debugging output.
*Mar 24 22:12:30.695: %OIR-6-CONSOLE: Changing console ownership to switch processor
*** System received a Cache Parity Exception ***
signal= 0x14, code= 0x84000000, context= 0x441ce024
PC = 0x4171295c, Cause = 0x820, Status Reg = 0x34018002
System Bootstrap, Version 8.5(3)
Copyright (c) 1994-2008 by cisco Systems, Inc.
Cat6k-Sup720/SP processor with 1048576 Kbytes of main memory
Autoboot: failed, BOOT string is empty
Autoboot executing command: "boot "

Hello Abubaker,
It crashed due to a parity error.
Imprecise Data Parity Error
Imprecise Data Parity Error
Which in other words means, a temporary error in memory. On single occurence adivice is to monitor the supervisor for re-occurence of such failure again. You can monitor it for 24 - 48 hours and if its a hard failure , the likelyhood of issue coming again is more and you need to replace supervisor. If it does not repeat you can consider this as a one time issue and contnue using it.
Hope this helps and please always rate useful posts.
Thanks,
Madhu

ARP cache poisoning detection disabled

Similar Messages

Maybe you are looking for