Vlan – Gratuitous arp and unicast flooding

arphpmac addressswitchingvlan

we have few 100s of access switches connecting to a core 10k in IRF. Here all our access is pretty much dumb does only L2 job. So what happens now is unicast flooding, technically MAC ages out, atleast it what I beleive. I agree one thing reducing the fault domain size, but incidentally, I would like to know is there gratuitous arp learning in 10K can help us reduce or eliminate this flooding. Because as and when you enable it, the switch can do a unicast GARP to keep the macs in table by preventing age out so that it will help us to stop flooding?

At a given time my core arp table table size is 14k and mac table size is ~10k.

Best Answer

Unicast flooding shouldn't happen when traffic is flowing in a somewhat predictable pattern.

Switches learn MAC-port associations by the source addresses of frames running through them. When there's been no traffic from a certain MAC address for the MAC-aging period the table entry is dropped. The next frame to that MAC is flooded to all ports, emulating a repeater hub.

To avoid active MACs being aged out you need to either raise the MAC-age period so that there's traffic from each source address within that period or you make sure that each active source MAC does send traffic within the period by e.g. sending a broadcast that will update all switches in the broadcast domain.

Unless you run some delicate L2 load-balancing, a very high edge fluctuation or similar it usually doesn't hurt raising the MAC-aging to one or more hours.

Related Solutions

Gratuitous ARP – How Gratuitous ARP Works

Gratuitous ARP is a sort of "advance notification", it updates the ARP cache of other systems before they ask for it (no ARP request) or to update outdated information.

When talking about gratuitous ARP, the packets are actually special ARP request packets, not ARP reply packets as one would perhaps expect. Some reasons for this are explained in RFC 5227.

The gratuitous ARP packet has the following characteristics:

Both source and destination IP in the packet are the IP of the host issuing the gratuitous ARP
The destination MAC address is the broadcast MAC address (ff:ff:ff:ff:ff:ff)
- This means the packet will be flooded to all ports on a switch
No reply is expected

Gratuitous ARP is used for some reasons:

Update ARP tables after a MAC address for an IP changes (failover, new NIC, etc.)
Update MAC address tables on L2 devices (switches) that a MAC address is now on a different port
Send gratuitous ARP when interface goes up to notify other hosts about new MAC/IP bindings in advance so that they don't have to use ARP requests to find out
When a reply to a gratuitous ARP request is received you know that you have an IP address conflict in your network

As for the second part of your question, HSRP, VRRP etc. use gratuitous ARP to update the MAC address tables on L2 devices (switches). Also there is the option to use the burned-in MAC address for HSRP instead of the "virtual"one. In that case the gratuitous ARP would also update the ARP tables on L3 devices/hosts.

Ethernet – Identify gratuitous ARP

You can identify Gratuitous ARPs by looking at the ARP Sender Protocol Address and ARP Target Protocol Address, so as you mentioned when they are the same it's a gratuitous ARP. See RFC 2002, Section 4.6 for a reference (the emphasis - !!!!> and <!!!! is mine)...

      4.6. ARP, Proxy ARP, and Gratuitous ARP

      <...>

      A Gratuitous ARP [23] is an ARP packet sent by a node in order to
      spontaneously cause other nodes to update an entry in their ARP
      cache.  A gratuitous ARP MAY use either an ARP Request or an ARP
      Reply packet.  In either case, the (!!!!>) ARP Sender Protocol Address
      and ARP Target Protocol Address are both set to the IP address
      of the cache entry to be updated (<!!!!), and the ARP Sender Hardware
      Address is set to the link-layer address to which this cache
      entry should be updated.  When using an ARP Reply packet, the
      Target Hardware Address is also set to the link-layer address to
      which this cache entry should be updated (this field is not used
      in an ARP Request packet).

      In either case, for a gratuitous ARP, the ARP packet MUST be
      transmitted as a local broadcast packet on the local link.  As
      specified in [16], any node receiving any ARP packet (Request or
      Reply) MUST update its local ARP cache with the Sender Protocol
      and Hardware Addresses in the ARP packet, if the receiving node
      has an entry for that IP address already in its ARP cache.  This
      requirement in the ARP protocol applies even for ARP Request
      packets, and for ARP Reply packets that do not match any ARP
      Request transmitted by the receiving node [16].

Best Answer

Related Solutions

Gratuitous ARP – How Gratuitous ARP Works

Ethernet – Identify gratuitous ARP

Related Topic