0

I have an ESXi cluster that hosts several Windows Server VMs and around 30 Windows workstation VMs. Packet captures show a high number of ARP replies of the form: -sender_ip: VM IP -sender_mac: VM virtual MAC -target_ip: 0.0.0.0 -target_mac: Switch interface MAC

The specific addresses aren't really a concern -- they're all legitimate and we're not having any problems with communications (most of the questions surrounding GARP and VMWare have to do with ping issues, a problem we don't have). I'm looking for an explanation of the traffic pattern in an environment that functions as expected.

So the question is why would I see a high number of unsolicited ARP replies? Is this a mechanism VMWare uses for some purpose? What is it? Is there an alternative?

EDIT: Quick diagram: [esxi]--[switch vlan]--[inline IDS]--[fw]--(rest of network)

The IDS is complaining about these unsolicited ARPs. Several IDS vendors trigger on ARP replies without a prior request, or for ARP replies that have a target IP of 0.0.0.0.

The target MAC in these replies is the VLAN interface on the switch.

Capture points: -The IDS grabs the offending packets -The FW can see the same ones -A VM on the ESXi host does not see these, although there is an ARP request for a specific IP on the ESXi host that has source_ip=0.0.0.0 and source_mac=[switch vlan interface].

I can't share the captures, unfortunately.

Really I'm interested in finding out if this is normal for an ESXi deployment.

jma
  • 109
  • 1
  • 3
  • Does the traffic look like [this](http://serverfault.com/questions/356423/why-does-a-pxe-booting-vm-aggressively-seek-reverse-arp)? – Shane Madden Aug 24 '14 at 17:18
  • No, there are no ARP requests corresponding to the replies (no "who-is" or "who-has" queries). The protocol parse in Wireshark shows the components as I described: sender_ip is a valid IP for a workstation VM; sender_mac is the correct MAC for that VM and IP; target_mac is the MAC address of the physical switch port, and target_ip is 0.0.0.0. – jma Aug 24 '14 at 17:34
  • Where do you capture this, and could you share such a capture? – Marki Aug 24 '14 at 18:57

0 Answers0