Cisco – Dynamic ARP Inspection Ports Err-Disable with %SW_DAI-4-PACKET_RATE_EXCEEDED

arpciscodhcp-snoopingport-security

Ports in my network on random switches(connected to Windows 7 workstations) are going into err-disable because of dynamic arp inspection. Ports are going into err-disable because there are too many arp requests packets per second.

Please see output from the log:

Mar  2 13:14:35 EST: %SW_DAI-4-PACKET_RATE_EXCEEDED: 21 packets received in 922 milliseconds 
on Gi1/0/6.
Mar  2 13:14:35 EST: %PM-4-ERR_DISABLE: arp-inspection error detected on Gi1/0/6, putting 
Gi1/0/6 in err-disable state
Mar  2 13:14:36 EST: %LINEPROTO-5-UPDOWN: Line protocol on Interface 
GigabitEthernet1/0/6, changed state to down

I was able to capture port going into error disable (through SPAN). Please see attached capture:
https://app.box.com/s/2ow0tlutzxwk5odk0zuqhug1kgqlykbd

The IP address of the workstation that is on port gig1/0/6 is 151.121.79.89.

As far as I see there are many ARP requests for 151.121.79.89 from random workstations at 13:14:34 and that is causing port to go into err-disable.

I am working with a Cisco WS-C2960S-48FPS-L

Port configuration is standard for all access ports:

switchport access vlan 79
switchport mode access
switchport voice vlan 3001
switchport port-security maximum 3
switchport port-security
switchport port-security aging time 2
switchport port-security violation restrict
ip arp inspection limit rate 20
srr-queue bandwidth share 1 30 35 5
queue-set 2
priority-queue out
mls qos trust device cisco-phone
mls qos trust cos
spanning-tree portfast
service-policy input AUTOQOS-SRND4-CISCOPHONE-POLICY
ip dhcp snooping limit rate 20

I'm also including the arp inspection config (the dhcp-snooping config on vlan 79 is typical): 

ip arp inspection vlan 79
ip arp inspection validate src-mac ip
ip arp inspection log-buffer entries 1024
ip arp inspection log-buffer logs 1024 interval 10

I am wondering why would random workstations try to resolve ip address of workstation connected to the 1/0/6 in less than a second?

Best Answer

ip arp inspection limit rate 20

20 packets per second is really low. If there's a server on that port (or more than one system), 20 pps is nothing.

Update

I don't know what any hosts are on your network (who's talking to who, and why), but for the minute at 13:14:34, 15 hosts asked who 89 was. And 89 asked who 5 hosts were. The request ~0.1sec before this period runs the total to 21pps. [filter: arp && (eth.src == 10:1f:74:f5:be:36)]

[Note: Cisco's default is even worse at 15.]

Related Topic