Community discussions

 
yacsap
Member Candidate
Member Candidate
Topic Author
Posts: 102
Joined: Wed Dec 17, 2014 11:44 am
Location: Auckland, New Zealand
Contact:

MikroTik IP ARP Print Mac 00:00:00:00:00:00

Tue May 10, 2016 6:20 am

Hi fellow MikroTik users,

Today I'm having strange issue, one of our RB Mac detected as 00:00:00:00:00:00 in ARP print list.

Image

Has anyone faced similar problem with mine?

I tried to plug into different ports, but still getting the same issue.
[ IMikroTik ] >
 
User avatar
macgaiver
Forum Guru
Forum Guru
Posts: 1721
Joined: Wed May 18, 2005 5:57 pm
Location: Sol III, Sol system, Sector 001, Alpha Quadrant

Re: MikroTik IP ARP Print Mac 00:00:00:00:00:00

Tue May 10, 2016 8:31 am

What's new in 6.32.4 (2016-Feb-09 09:17):

*) arp - show incomplete ARP entries;
it is feature not an issue.
With great knowledge comes great responsibility, because of ability to recognize id... incompetent people much faster.
 
yacsap
Member Candidate
Member Candidate
Topic Author
Posts: 102
Joined: Wed Dec 17, 2014 11:44 am
Location: Auckland, New Zealand
Contact:

Re: MikroTik IP ARP Print Mac 00:00:00:00:00:00

Tue May 10, 2016 2:56 pm

But I couldn't ping 10.0.0.75 and/or any other devices with mac 00:00:00:00:00:00 :shock:
[ IMikroTik ] >
 
User avatar
janisk
MikroTik Support
MikroTik Support
Posts: 6283
Joined: Tue Feb 14, 2006 9:46 am
Location: Riga, Latvia

Re: MikroTik IP ARP Print Mac 00:00:00:00:00:00

Tue May 10, 2016 4:10 pm

AFAIK - incomplete ARP entry is created when the request for ARP for IP address comes up empty. That is, in the Ethernet someone broadcasts for ARP for an IP address and nobody is responding.

So, the fact that you cannot ping actually is the reason why incomplete ARP entry is in the table not the cause.
 
yacsap
Member Candidate
Member Candidate
Topic Author
Posts: 102
Joined: Wed Dec 17, 2014 11:44 am
Location: Auckland, New Zealand
Contact:

Re: MikroTik IP ARP Print Mac 00:00:00:00:00:00

Tue May 10, 2016 10:34 pm

Hi Janisk,

Thanks for replying, how can I reproduce this issue?
Because we didn't change anything recently.

Could this be device malfunctioning?
[ IMikroTik ] >
 
User avatar
ZeroByte
Forum Guru
Forum Guru
Posts: 4051
Joined: Wed May 11, 2011 6:08 pm

Re: MikroTik IP ARP Print Mac 00:00:00:00:00:00

Tue May 10, 2016 10:53 pm

Hi Janisk,

Thanks for replying, how can I reproduce this issue?
Because we didn't change anything recently.

Could this be device malfunctioning?
Nope - this isn't a malfunction. Here's how to reproduce the results. (not an issue):

from some host whose traffic goes through the router, but is not in the same network as 10.0.0.X - ping any IP address that you know is not in use.
You will see the address appear in the ARP table with all-zero MAC address.

Any time any packet comes into the router with a destination address that is not in the ARP table, the router must send an ARP request to learn the MAC address of that host. Usually, the host is really there and so it replies to the ARP, and the MAC changes from all-zeros to being the actual MAC of the host.

So - if you see all-zero MAC addresses, that means there are packets going through the router with destination addresses that don't correspond to a real host. What could be some causes of this?

Network scans
Someone mis-types an address.
The missing host WAS online, and was talking to some other host, and then disconnected, but the remote host is still trying to reach the disconnected host. (are you still there? Hello? If you're there, I can't hear you... hello???)
Network scans

Yes, I typed network scans twice. Try looking at the ARP table on an interface with a public IP range attached to it, and you'll see tons of these.
When given a spoon,
you should not cling to your fork.
The soup will get cold.
 
Senux
newbie
Posts: 33
Joined: Wed Jun 30, 2010 6:19 pm

Re: MikroTik IP ARP Print Mac 00:00:00:00:00:00

Tue May 10, 2016 11:51 pm

This is bug happily existing in 6.35.2 as well

What's new in 6.35 (2016-Apr-14 12:55):
*) arp - apply Linux Kernel patch to stop RouterOS from randomly exhibiting misplaced ARPs;
 
R1CH
Forum Veteran
Forum Veteran
Posts: 904
Joined: Sun Oct 01, 2006 11:44 pm

Re: MikroTik IP ARP Print Mac 00:00:00:00:00:00

Wed May 11, 2016 12:03 am

Read the post above, this is not a bug. It's standard Linux behavior.
 
yacsap
Member Candidate
Member Candidate
Topic Author
Posts: 102
Joined: Wed Dec 17, 2014 11:44 am
Location: Auckland, New Zealand
Contact:

Re: MikroTik IP ARP Print Mac 00:00:00:00:00:00

Wed May 11, 2016 12:05 am

Hi ZeroByte,

Thank you for your explanation.

I will investigate that particular device then, because maybe someone is looking into that IP address, and the device is not responding.

And I thank you to all who has responded to this thread :D
[ IMikroTik ] >
 
User avatar
ZeroByte
Forum Guru
Forum Guru
Posts: 4051
Joined: Wed May 11, 2011 6:08 pm

Re: MikroTik IP ARP Print Mac 00:00:00:00:00:00

Wed May 11, 2016 12:17 am

Hi ZeroByte,

Thank you for your explanation.

I will investigate that particular device then, because maybe someone is looking into that IP address, and the device is not responding.

And I thank you to all who has responded to this thread :D
Whenever someone requests an IP address for a new server or something here at my office, since the IP list has errors in it (don't get me started), I ALWAYS do a ping and then check the ARP table in the router for an incomplete entry before I will consider it CLEAR. (Hosts may drop all incoming packets, but they can't drop ARP requests, so I consider that the most reliable scan of all)

I wouldn't concern myself with them - our public-IP border router has.... (checking) 21 such entries right now.
I'd be more concerned if there WEREN'T any.... if your public IP network isn't getting scanned, then it's down. ;)
When given a spoon,
you should not cling to your fork.
The soup will get cold.
 
Senux
newbie
Posts: 33
Joined: Wed Jun 30, 2010 6:19 pm

Re: MikroTik IP ARP Print Mac 00:00:00:00:00:00

Wed May 11, 2016 12:02 pm

Read the post above, this is not a bug. It's standard Linux behavior.
Read whats new:
What's new in 6.35 (2016-Apr-14 12:55):
*) arp - apply Linux Kernel patch to stop RouterOS from randomly exhibiting misplaced ARPs

I have issue with this too - not valid LAN IP address with mac 00:00:00... - it is only one PC on my network and nobody search and pinging for this ghost address. This is not corrected with version 6.35, 6.35.1 and 6.35.2
 
User avatar
ZeroByte
Forum Guru
Forum Guru
Posts: 4051
Joined: Wed May 11, 2011 6:08 pm

Re: MikroTik IP ARP Print Mac 00:00:00:00:00:00

Wed May 11, 2016 5:35 pm

Read the post above, this is not a bug. It's standard Linux behavior.
Read whats new:
What's new in 6.35 (2016-Apr-14 12:55):
*) arp - apply Linux Kernel patch to stop RouterOS from randomly exhibiting misplaced ARPs

I have issue with this too - not valid LAN IP address with mac 00:00:00... - it is only one PC on my network and nobody search and pinging for this ghost address. This is not corrected with version 6.35, 6.35.1 and 6.35.2
Apparently this issue was that the Mikrotik would ARP on the wrong interface for addresses...

I bet if you run a sniffer on all interfaces, filtered to that IP address, you'll see some packet entering the router with that destination IP.
When given a spoon,
you should not cling to your fork.
The soup will get cold.
 
diablothebest
newbie
Posts: 27
Joined: Fri May 20, 2016 11:07 pm

Re: MikroTik IP ARP Print Mac 00:00:00:00:00:00

Sun May 29, 2016 5:10 pm

I have this issue to in 6.35.2
Снимок экрана 2016-05-29 в 15.36.51.png
You do not have the required permissions to view the files attached to this post.
 
R1CH
Forum Veteran
Forum Veteran
Posts: 904
Joined: Sun Oct 01, 2006 11:44 pm

Re: MikroTik IP ARP Print Mac 00:00:00:00:00:00

Mon May 30, 2016 6:51 pm

What's the issue? Looks like it's on the right interface. Just because there's a DHCP lease assigned doesn't mean the machine is still active and responding to arp.
 
diablothebest
newbie
Posts: 27
Joined: Fri May 20, 2016 11:07 pm

Re: MikroTik IP ARP Print Mac 00:00:00:00:00:00

Thu Jun 02, 2016 11:53 pm

Ok! May its not a problem. But on 6.35.2 I have big issue! All remote clients cant get IP - I got errors in log about DHCP lease offered! Cant fix it! Just update server to RC version!
 
pe1chl
Forum Guru
Forum Guru
Posts: 5919
Joined: Mon Jun 08, 2015 12:09 pm

Re: MikroTik IP ARP Print Mac 00:00:00:00:00:00

Fri Jun 03, 2016 8:51 am

You must have a configuration error somewhere.

Who is online

Users browsing this forum: No registered users and 108 guests