All other Cisco networking related discussions.
espritlibre
New Member
Posts:
5
Joined:
Sun Mar 06, 2016 7:46 am

ARP Flip flop with brand new PC over LAN

Wed Apr 12, 2017 3:46 pm

Hi
I'm experiencing a very strange behaviour in our LAN.

This is our net topology:
topology.png
topology.png (26 KiB) Viewed 6578 times


We've bought a brand new PC from Acer and configured its IP ethernet interface statically this way: 192.168.0.238/24 gw 192.168.0.10 dns 8.8.8.8.

When we fisically connect the brand new PC to the LAN, it starts impersonating our gateway!

It starts responding ARP queries for 192.168.0.10 saying it is 192.168.0.10. This way, other PC's in the LAN cannot reach real gateway anymore.

Using ARP monitoring software, I can see ARP flip flop's for IP 192.168.0.10 between real gateway and the new PC.

I then disabled the ethernet adapter, bought a chinese USB-Ethernet adapter and... voilà, it works normally!

What's happening?

espritlibre
New Member
Posts:
5
Joined:
Sun Mar 06, 2016 7:46 am

Re: ARP Flip flop with brand new PC over LAN

Sat Apr 15, 2017 6:22 pm

Here it is a screenshot from Wireshark running on .236:

arp duplicate.png
arp duplicate.png (35.23 KiB) Viewed 6453 times


The new PC is ARP replying to both IP addresses: its own, 238, and the gateway one, 10!
How can it send out ARP replies using IP source address == 192.168.0.10 ?!

Another brand new PC (bought from another vendor) does the same.
The only thing they seems to have in common is a Realtek ethernet adapter.

Any idea?


Return to Cisco General

Who is online

Users browsing this forum: Annoboday, effessiot, Exabot [Bot], MevyEvolleyJeno, Stydaynotosse and 36 guests