Re: arp cache incomplete entries

[Neal Murphy <neal.p.murphy@alum.wpi.edu>]

On Saturday, October 13, 2012 12:23:31 AM Panayiotis Karabassis wrote:
> 
> In a pattern that is becoming all too familiar, the problematic machine
> sends an ARP request, to which the nameserver replies. But the reply is
> never received by the asking machine. So says wireshark.
> 
> Could this be a fault NIC, or is the packet lost somewhere else?

It's not unknown. First, verify that the ARP cache is correct (host names/adds 
match the MAC addrs) on both hosts; on GNU/linux, use 'arp'. Second, directly 
connec the requester to the target (use a crossover cable if neither NIC is 
GigE). If the ARP tables are correct and direct connection works, then look in 
between them; specifically, look for a bad switch (some switches are known to 
corrupt their ARP tables and, thus, no longer function correctly as L2 
switches). If direct connection doesn't work (with and without crossover 
cable), then start looking at the NICs.

If you cannot directly observe the NICs (with tcpdump or equiv.), then you'll 
have to deduce the fault by observing whatever traffic that *does* traverse 
the LAN.