How Cisco represent Arp entry's aging time in SNMP MIB

Hi there,
I found : when a laptop roamed between an office and a meeting room and used two different IP addressed in these two places, there are two active IP arp entry in Cisco with different aging time.
Please see the screenshot for "sh ip arp". My question is how Cisco represent the aging time in SNMP MIB. Is there any cisco proprieatry MIB to represent the aging. I want find the latest arp entry from SNMP. I can't see any useful field in ipNetToMediaEntry, ipNetToPhysicalEntry and cInetNetToMediaEntry.
Not sure if cInetNetToMediaLastUpdated is related, but I have never get any snmpwalk result from this oid yet.
Liam

This value is not available via SNMP.
This information comes via IP-MIB and the IP-MIB's ipNetToMedia table will just give you the hardware address, network address, associated interface, and entry type (e.g. static, dynamic, etc.).
-Thanks
Vinod

Similar Messages

Aging Time

Hi,
I would like to ask What is Aging Time and its purpose.
Thanks,
Dyep

For the original poster, although Giuseppe provides an excellent description of the MAC aging timer in reference to CAMs, and since you mark his post as resolving your question, I just want to re-emphise in reference to your original question there are multiple aging timers, a couple besides ARP's and CAM's. The principle is generally the same, and such timers might be adjusted for various reasons. (For example, setting ARP and CAM aging timers can make or break unicast flooding.)
[edit]
I wrote too soon, see you've marked my original post as also resolving your question. BTW: The interplay between ARP and MAC aging timer, and how it can cause unicast flooding, I think, is worth knowing. You might want to read http://www.cisco.com/en/US/products/hw/switches/ps700/products_tech_note09186a00801d0808.shtml

Duplicate material entry at the time of PO creation based order type

How Restrict duplicate material entry at the time of PO creation based on define order type.
Moderator message: please do some research before asking.
Edited by: Thomas Zloch on Mar 11, 2011 1:45 PM

Hi Rahul,
try with This Badi ME_PROCESS_PO , Method Open or Process item,
Implemente it and use a break-point to test it i.e it is triggred or nt , before processing it.
Regards,
Abhisek

My iPad is locked out. How can I restore entry?

My iPad is locked out. How can I restore entry?

Reset time. Press and hold both the power and home buttons for 10-15 seconds till the Apple logo appears. Then release both buttons. Wait 15-20 seconds for your iPad to start on it's own.

How to setup a static multicast ARP entry with Cisco SF300-08?

We're running a cluster in multicast mode as a loadbalancer.
We have Cisco SF300-08 and when we adding a static ARP entry results in an error message telling the user that the hardware address needs to be a valid unicast MAC address.
So how to setup a static multicast in Cisco SF300 or maybe someone know other solution to setup multicastes mode in Cisco SF300.

Hi, Tom!
We have two watchguard xtm505(cluster active-active) in our network. Watchguard interfaces have one ip and one mac adresses. IP 192.168.111.1(Unicast) and MAC 01:00:5e:02:02:03(multicast). Cisco SF300 is router to outside networks(to internet). Cisco IP adresss is 192.168.111.254. There are another some hosts in this network.
Ping from hosts to 192.168.111.254 works well. Ping from hosts to 192.168.111.1 works well too. But there is no ping from watchguard cluster(192.168.111.1) to Cisco(192.168.111.254). And there is no routing to internet
This is well-known situation. We need to do following(example for cisco 3750):
1.    Start the Cisco 3750 command line interface.
2.    Add a static ARP entry for the multicast MAC address of the FireCluster interface.
Type this command:
arp arpa
For this example, type:
arp 192.168.111.1 01:00:5e:02:02:03 arpa
3.    Add an entry to the MAC address table.
Type this command:
mac-address-table static vlan interface <#>
For this example, type:
mac-address-table static 01:00:5e:02:02:03 vlan 1 interface gi1/0/11
But we can't add arp entry on Cisco SF300. CLI tells us "MAC address illegal"!
We tried enable igmp snooping, but is not helps.
Could you tell more detailed about MAC groups?

ARP Aging Time

Hi there,
Just wondering why, when i do show arp, in my WS-C4506, whith Supervisor II+ 1000BaseX, and cat4000-i9k91s-mz.122-25.EWA5.bin, it seems that i have +/- 20 % of arp entrys with the aging time of 0 sec all the time.
I think it should increment that aging time till 300 sec (by default), and then reset, but not all the entries do it.
Any ideias of what kind of "process" is causing it ?
I have all in the vlan1, and the ip's that soffer this issue are hosts and Cisco equipments.
Thank you in advance.
Petr?nio

Friend,
I think you are a little confused with the ARP aging time and the mac-address aging time (also called as CAM table)
The default ARP aging time is 4 hours but the switch hold the CAM table entires only for 5 minutes.
http://www.cisco.com/en/US/products/hw/switches/ps708/products_tech_note09186a00807347ab.shtml#troubleshoot
A permanent ARP entry does not have any timer assoiciated with it and is not shown as "0" but as "-".
The thing which you are seeing is basically the cam is being aged out after 5 mins from the switch and is not incrementing as no frames are being received on the port.
HTH, rate if it does
Narayan

How to add an "age / time counter" into DW?

Can anyone assist on how to add an age / time counter into DW?
In other words to say "Child X is now a years, b months old"? or "Product Z was launched A years B months ago"? Or, on the other hand, "You only have Z days & Y minutes left to enter"? With it updating in real time?
Apologies in advance if this is a silly / obvious question but I just can't seem to do it!

This isn't something you would add to DW, you would need to add it to your webpages. You would do this with javascript. Search the web for
'javascript countdown timer' for plenty of examples.

How to find latest entry in the table according to time

how to find latest entry in the table according to the time
is there any function module to do so
\[removed by moderator\]
Regards
Shashi
Edited by: Jan Stallkamp on Aug 25, 2008 4:39 PM

Hi,
If you want to read the entry from an internal table,
sort the internal table in the descending order by the time and
delete adjacent duplicates by comparing the fields other than time and the internal table will have the latest record.
Suggestion: instead of only time try to have one more field called date with the time combination
Regards,
Ramesh

Arp aging time on router and mac address aging time on switches set close t

Hi,
appreciate some advice on the following:
what is the benefit of setting arp aging time on router and mac address aging time on switches close to each other?
Thanks,
Christina

Hi,
based on the below output, do you think implementing it will benefit? Thanks.
C2950#sh int fa0/43
FastEthernet0/43 is up, line protocol is up (connected)
Hardware is Fast Ethernet, address is 000d.5e11.4e2b (bia 000d.5e11.4e2b)
MTU 1500 bytes, BW 100000 Kbit, DLY 1000 usec,
reliability 255/255, txload 7/255, rxload 2/255
Encapsulation ARPA, loopback not set
Keepalive set (10 sec)
Full-duplex, 100Mb/s
input flow-control is off, output flow-control is off
ARP type: ARPA, ARP Timeout 04:00:00
Last input never, output 00:00:00, output hang never
Last clearing of "show interface" counters never
Input queue: 0/75/0/0 (size/max/drops/flushes); Total output drops: 0
Queueing strategy: fifo
Output queue: 0/40 (size/max)
5 minute input rate 933000 bits/sec, 149 packets/sec
5 minute output rate 2981000 bits/sec, 263 packets/sec
2819781393 packets input, 3782332886 bytes, 0 no buffer
Received 266693 broadcasts (0 multicast)
0 runts, 0 giants, 0 throttles
0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored
0 watchdog, 0 multicast, 0 pause input
0 input packets with dribble condition detected
4015025747 packets output, 2328228393 bytes, 0 underruns
0 output errors, 0 collisions, 2 interface resets
0 babbles, 0 late collision, 0 deferred
0 lost carrier, 0 no carrier, 0 PAUSE output
0 output buffer failures, 0 output buffers swapped out
C2950#

CAM aging time VS Port-security aging time

Hi All
Please advise on the following:
- Without port-security configured, MACs per interface are learnt as "Dynamic" entries and the global CAM aging timer applies (300 seconds) unless tweaked manually.
- With switchport port-security enabled (without port-security mac-address sticky, which holds onto MACs infinitely) I see MACs being learnt as "Secure-Dynamic" in a show port-security interface gix/x output and as "Static" in the output of show mac address-table interface gix.x .
What I want to know is if JUST port-security is applied (without mac-address sticky) do the default CAM aging timer of 300 seconds get applied to these MACs too? as I see their is also a option to configure port-security mac-address aging time / type, does this overrule / take precedence over the default CAM aging timer?
Please assist, its not documented anywhere and its driving me a bit nuts!
Thanks folks

What I want to know is if JUST port-security is applied (without mac-address sticky) do the default CAM aging timer of 300 seconds get applied to these MACs too?
Any aging time you configure with port security will take precedence over the default aging time.
See this thread for details -
https://supportforums.cisco.com/discussion/11054341/switchport-port-security-commands-help
Jon

802.1x router loses ARP entry

Firs of all, Hello All. In new to this community.
A have a strange problem i want to share with you. Possibly a bug but maybe it is me who does something wrong.
My network looks like this:
[RADIUS] --- [C881] --- [SG200 Switch] ---[WinXP]
One of SG200 interfaces is set as a Supplicant ant it authenticates in RADIUS (FreeRADIUS) server via C881 router. WinXP and other PC clients authenticate in RADIUS via SG200.
Now: Authentication works perfectly. Ports open as they're supposed to. I'm able to reach RADIUS from SG200 and vice versa but there is a problem with WinXP. When i connect it to SG200 it authenticates, port opens and I'm able to reach RADIUS or any host on the left hand side but only for 300 seconds. After that period of time C881 looses WinXP from its ARP table and any communication fails. I cant even reach C881's interface facing SG200. Then i type:
c881(config-if)#dot1x port-control force-authorized
C881 learns WinXP's MAC and IP again and all gets back to normal. When I type
c881(config-if)#dot1x port-control auto
after 300 seconds C881 forgets WinXP again and communication brakes down.
How is it possible that a router forgets MAC of host its continuously "talking" with?
Have you ever seen this kind of behaviour? I tried with two other software revisions on C881 and resoult is always the same. Bug or feature?

Hi.
Are you sending the session-attribute from the free radius server?
To be honest im not sure what you mean, but i have strong suspicion that my problem has nothing with freeradius.
Host authentication works perfectly. When i connect WinXP directly to routers switch ports everything works fine. Either the switch itself has a connection to the router all the time - even when WinXP and C881 dont see each other.
Furthermore - All ports are authenticated and open all the time, its' state doesn't change. Reauthentiction is turned off.
When the problem occurs i see no traffic to radius server. hre is how it looks:
When i connect WinXP to the switch it works at the begining.
I check ARP table on the router - WinXP is there.
I periodically check ARP table and after ap. 300 seconds (default arp entry timeout) WinXP disappears and communication brakes down.
Additionally when i change ARP timeout value to shorter or longer communication breaks earlier or later respectivly

Static Arp Entry for Exchange 2010

Hello All,
I was hoping someone could assist with an issue that our Exchange team are having, specifically with replication traffic traversing our DC to DR site.
The infrastructure consists of a Layer 3 data centre and a disaster recovery site, so essentially its a live/backup environment. Both the DC and DR site are connected with a LES using routed interfaces.
The Exchange cluster at the DC is associated with the following subnets:
MAPI - 10.1.30.X
Replication: 10.1.230.X
DR site has the following subnets associated with the exhange cluster :
MAPI - 192.168.4.X
Replication - 192.168.230.X
When an attempt is made to create a database/mailbox on an exchange server at the DC and copy it using the replication subnet source: 10.1.230.X to destination subnet: 192.168.230.X, the copy process fails.
Replication traffic in general going from DC to DR or vice-versa is subject to constant problems and seems unreliable. Our exchange team have to manually copy mailboxes from one cluster to the other using Windows explorer which works fine.
The Exchange cluster at both sites reside within a VMWare ESX enclosure and connect to Cisco 6500 switches. Would the Cisco switches require a static arp entry for their respective Exchange clusters, which should be configured on each switch? If this was missing could this be the root cause of the replication problems we're experiencing? Or does this depend on whether the exchange cluster is using NLB Unicast or Multicast mode?
Any assistance would be most appreciated.
Regards,
Jamie

Jamie,
Have a look at this link:-
http://www.cisco.com/en/US/products/hw/switches/ps708/products_configuration_example09186a0080a07203.shtml
It depends on how the team NLB is set up.
You may need static mac & static arp as well as disabling igmp snooping if multicasting is bein used.
Regards,
Alex.
Please rate useful posts.

ASA5510 no ARP entry ?

I have a requirement to NAT a spare address on the same subnet range as one of the firewall interface - however, because this is not allocated to a physical interface, there is no mac entry in the arp cache. the other end of the link from the firewall is connected to a router which has no idea how to reach this "virtual address" - again because there is no entry in the arp cache
I have tried to put a static arp entry into the firewall but this doesn't appear to work either. Should I be using a mac address form a physical interface or can I create a dummy mac for this -
If the router can't see the ip address, then users will not be able to target this address - so that the firewall can NAT to the real outside address.
I have tried routes to null0 on the router and static arp entries on both devices but the user just times when trying to connect to 10.2.7.11 (nat to 10.2.32.11)
attached is a very basic visio diagram which I hope explains what I am trying to achieve.
any help would be appreciated.
many thanks

Assuming your communications are always initiated from the inside, the first static statement above should suffice. When a session is built (initial syn in the TCP 3-way handshake) the xlate table will take care of the NAT on return path. I'm not sure of the effect of the second static, but I'd try temporaily removing it.
If you ever initiate from the outside (10.2.32.11/12), you would also need an access-list to allow moving from a lower security to higher security level.
Hope this helps.

Arp entries on 3850

On my 3850 (running 3.3.1) i have 1600+ entries in the arp table for a given vlan but I'm not acting as the gateway for the devices connecting to it (i'm trunked to the core which is acting as the gateway but I do have ip routing enabled on my 3850). I've put the nmsp attachment suppress command on all physical interfaces to resolve another issue I was having.
Is having all these arp entries expected behavior? I've tried to delete 1 ip in the table which I knew wasn't valid but my switch seems to ignore it as the entry is still there.
The reason I ask was due to a small unicast flooding issue I seemed to have (since gone away). I was told it may have been due to the switch having an arp entry for a mac addresses it didn't know and hence was flooding the switch. The person was surprised to see so many arp entries given i wasn't a gateway for this vlan.
Thanks

Hi,
If you issue "show running config all" command you can see all configuration lines of this switch including the default settings. Here is an example for one of the vlan interface configuration. As you can see "proxy-arp" is enabled globally & interface level by default.
3850-2#sh running-config all | in proxy
no ip arp proxy disable
3850-2#sh running-config all | be interface Vlan1410
interface Vlan1410
ip address 10.141.103.242 255.255.248.0
ip redirects
ip unreachables
ip proxy-arp
ip mtu 1500
ip load-sharing per-destination
ip cef accounting non-recursive internal
ip pim dr-priority 1
ip pim query-interval 30
ip mfib forwarding input
ip mfib forwarding output
ip mfib cef input
ip mfib cef output
ip route-cache cef
ip route-cache
ip split-horizon
ip igmp last-member-query-interval 1000
ip igmp last-member-query-count 2
ip igmp query-max-response-time 10
ip igmp version 2
ip igmp query-interval 60
ip igmp tcn query count 2
ip igmp tcn query interval 10
load-interval 300
carrier-delay 2
no shutdown
ipv6 nd reachable-time 0
ipv6 nd ns-interval 0
ipv6 nd dad attempts 1
ipv6 nd prefix framed-ipv6-prefix
ipv6 nd nud igp
ipv6 nd ra lifetime 1800
ipv6 nd ra interval 200
ipv6 redirects
ipv6 unreachables
snmp trap link-status
cts role-based enforcement
arp arpa
arp timeout 14400
spanning-tree port-priority 128
spanning-tree cost 0
hold-queue 75 in
hold-queue 40 out
no bgp-policy accounting input
no bgp-policy accounting output
no bgp-policy accounting input source
no bgp-policy accounting output source
no bgp-policy source ip-prec-map
no bgp-policy source ip-qos-map
no bgp-policy destination ip-prec-map
no bgp-policy destination ip-qos-map
This post explain "proxy-arp" behaviour well.
http://www.cisco.com/c/en/us/support/docs/ip/dynamic-address-allocation-resolution/13718-5.html
In your case all the SVI defined & end host gets default-gateway IP correctly, there is no need for "proxy-arp" enabled on SVI. You can safely disable it (globally or interface level) and check if that help to mitigate your arp cache issue.
3850-2(config)#ip arp proxy disable
or
3850-2(config)#int vlan 1410
3850-2(config-if)#no ip proxy-arp
HTH
Rasika
**** Pls rate all useful responses ****

ARP Entry not seen in Backup Router

Hi,
we have two routers,one primary and a secondary configured with HSRP.HSRP is working fine.
But when we see the arp entry in these routers,for some given IPs, the arp entry is listed in primary router but not in the secondary router.
Also,Cam Entries can be seen in the switch, but arp entry can't be seen in MSFC (ie Secondary Router).
Can anyone address this issue??
Regards,
Nirmal.

Nirmal,
By default, ARP entries age out of the ARP cache after certain period of time (i believe it's 4 hrs). Since the standby HSRP device wouldn't be forwarding any traffic to the hosts this behavior is normal. Should the standby HSRP router become the active one and then it would arp and resolve the IP to MAC address.
Pls. rate all helpful posts.
HTH,
Sundar

How Cisco represent Arp entry's aging time in SNMP MIB

Similar Messages

Maybe you are looking for