- This topic has 2 replies, 2 voices, and was last updated 18 years, 11 months ago by
.
-
Posts
-
Hello Fellow Mac and System Admins,
Q: How to control the number and validity of ARP requests broadcast from a Macintosh NIC?
In a nutshell, one of my clients, a very, very large enterprise for which I admin 12 Mac users, has just implemented an ARP-based, Ethernet node security.
When invalid or too many ARP requests are made in x number of milliseconds, the Ethernet node is automatically turned OFF at the switch.
The 12 Macs are fine on the network for the following: they properly acquire IPs via DHCP, they connect to the local AD service, they can see network shares and printers, web, email, etc.
However the fit-hits-the-shan within a second of pressing Command-P to print something…anything. At that moment the ARP security kicks in and disables DHCP to the MAC address of the requesting Macintosh.
All printers are config’d via LPR, AppleTalk is OFF on the Macs and the printers themselves (all HPs).
I’ve tried Firewalling mDNSResponder and mDNS (TCP/UDP 5353 and 5354), running in Stealth mode (all Macs run OS 10.4.10), blocking all UDP (breaks SMB ), I’ve unloaded mDNSResponder but that breaks too many other things (i.e. Suitcase Fusion 12.1.6), I’ve checked CUPS options and no luck.
Following is the Ethernet switch’s log dump indicating the invalid ARP requests and the rate-exceeding error.
I’m just hoping one of you folks is a network engineer as much as a system admin because this one is giving me gray hairs (OK…even MORE gray hairs).
I appreciate any info offered.
Kind regards to all.
Steven
======Log Dump Begins Here======
Nov 1 16:52:04.973: %SW_DAI-4-DHCP_SNOOPING_DENY: 3 Invalid ARPs (Req) on Gi5/40, vlan 10.([001b.63a5.3305/0.0.0.0/0000.0000.0000/169.254.203.207/16:52:04 PST Thu Nov 1 2007])Nov 1 16:52:05.617: %IP_SOURCE_GUARD-4-IP_SOURCE_GUARD_DENY_PACKET: IP Source Guard detects and drops illegal traffic on port Gi5/40 and vlan 10, drop packet count is 1.
Nov 1 16:52:06.033: %SW_DAI-4-DHCP_SNOOPING_DENY: 1 Invalid ARPs (Req) on Gi5/40, vlan 10.([001b.63a5.3305/0.0.0.0/0000.0000.0000/169.254.203.207/16:52:04 PST Thu Nov 1 2007])
Nov 1 16:52:06.033: %SW_DAI-4-DHCP_SNOOPING_DENY: 3 Invalid ARPs (Req) on Gi5/40, vlan 10.([001b.63a5.3305/0.0.0.0/0000.0000.0000/10.22.12.86/16:52:05 PST Thu Nov 1 2007])
Nov 1 16:52:06.033: %SW_DAI-4-DHCP_SNOOPING_DENY: 2 Invalid ARPs (Req) on Gi5/40, vlan 10.([001b.63a5.3305/169.254.203.207/0000.0000.0000/169.254.203.207/16:52:05 PST Thu Nov 1 2007])
Nov 1 16:52:07.037: %SW_DAI-4-DHCP_SNOOPING_DENY: 1 Invalid ARPs (Req) on Gi5/40, vlan 10.([001b.63a5.3305/0.0.0.0/0000.0000.0000/10.22.12.86/16:52:06 PST Thu Nov 1 2007])
Nov 1 17:00:40.553: %SW_DAI-4-PACKET_RATE_EXCEEDED: 16 packets received in 139 milliseconds on Gi5/40.
Nov 1 17:00:40.553: %PM-4-ERR_DISABLE: arp-inspection error detected on Gi5/40, putting Gi5/40 in err-disable state
smith456 wrote:
Hello Fellow Mac and System Admins,
Q: How to control the number and validity of ARP requests broadcast from a Macintosh NIC?
In a nutshell, one of my clients, a very, very large enterprise for which I admin 12 Mac users, has just implemented an ARP-based, Ethernet node security.
When invalid or too many ARP requests are made in x number of milliseconds, the Ethernet node is automatically turned OFF at the switch.
The 12 Macs are fine on the network for the following: they properly acquire IPs via DHCP, they connect to the local AD service, they can see network shares and printers, web, email, etc.
However the fit-hits-the-shan within a second of pressing Command-P to print something…anything. At that moment the ARP security kicks in and disables DHCP to the MAC address of the requesting Macintosh.
All printers are config’d via LPR, AppleTalk is OFF on the Macs and the printers themselves (all HPs).
I’ve tried Firewalling mDNSResponder and mDNS (TCP/UDP 5353 and 5354), running in Stealth mode (all Macs run OS 10.4.10), blocking all UDP (breaks SMB ), I’ve unloaded mDNSResponder but that breaks too many other things (i.e. Suitcase Fusion 12.1.6), I’ve checked CUPS options and no luck.
Following is the Ethernet switch’s log dump indicating the invalid ARP requests and the rate-exceeding error.
I’m just hoping one of you folks is a network engineer as much as a system admin because this one is giving me gray hairs (OK…even MORE gray hairs).
I appreciate any info offered.
Kind regards to all.
Steven
======Log Dump Begins Here======
Nov 1 16:52:04.973: %SW_DAI-4-DHCP_SNOOPING_DENY: 3 Invalid ARPs (Req) on Gi5/40, vlan 10.([001b.63a5.3305/0.0.0.0/0000.0000.0000/169.254.203.207/16:52:04 PST Thu Nov 1 2007])Nov 1 16:52:05.617: %IP_SOURCE_GUARD-4-IP_SOURCE_GUARD_DENY_PACKET: IP Source Guard detects and drops illegal traffic on port Gi5/40 and vlan 10, drop packet count is 1.
Nov 1 16:52:06.033: %SW_DAI-4-DHCP_SNOOPING_DENY: 1 Invalid ARPs (Req) on Gi5/40, vlan 10.([001b.63a5.3305/0.0.0.0/0000.0000.0000/169.254.203.207/16:52:04 PST Thu Nov 1 2007])
Nov 1 16:52:06.033: %SW_DAI-4-DHCP_SNOOPING_DENY: 3 Invalid ARPs (Req) on Gi5/40, vlan 10.([001b.63a5.3305/0.0.0.0/0000.0000.0000/10.22.12.86/16:52:05 PST Thu Nov 1 2007])
Nov 1 16:52:06.033: %SW_DAI-4-DHCP_SNOOPING_DENY: 2 Invalid ARPs (Req) on Gi5/40, vlan 10.([001b.63a5.3305/169.254.203.207/0000.0000.0000/169.254.203.207/16:52:05 PST Thu Nov 1 2007])
Nov 1 16:52:07.037: %SW_DAI-4-DHCP_SNOOPING_DENY: 1 Invalid ARPs (Req) on Gi5/40, vlan 10.([001b.63a5.3305/0.0.0.0/0000.0000.0000/10.22.12.86/16:52:06 PST Thu Nov 1 2007])
Nov 1 17:00:40.553: %SW_DAI-4-PACKET_RATE_EXCEEDED: 16 packets received in 139 milliseconds on Gi5/40.
Nov 1 17:00:40.553: %PM-4-ERR_DISABLE: arp-inspection error detected on Gi5/40, putting Gi5/40 in err-disable state
Interesting – as of yesterday I’m seeing the same symptoms, but have no idea as to the cause. This is an Xserve running 10.4.11:
Dec 11 13:16:45: %SW_DAI-4-DHCP_SNOOPING_DENY: 1 Invalid ARPs (Req) on Po1, vlan 380.([000d.939d.679a/169.254.75.227/0000.0000.0000/128.180.41.1/13:16:44 EST Tue Dec 11 2007])
Dec 11 13:17:54: %SW_DAI-4-PACKET_RATE_EXCEEDED: 16 packets received in 469 milliseconds on Po1.
Dec 11 13:17:54: %PM-4-ERR_DISABLE: arp-inspection error detected on Gi1/0/37, putting Gi1/0/37 in err-disable state
Dec 11 13:17:54: %PM-4-ERR_DISABLE: arp-inspection error detected on Gi1/0/42, putting Gi1/0/42 in err-disable state
Dec 11 13:17:55: %LINEPROTO-5-UPDOWN: Line protocol on Interface Port-channel1, changed state to down
Dec 11 13:17:56: %LINK-3-UPDOWN: Interface Port-channel1, changed state to downpabugeater,
The ‘snooping’ entry was from my attempt at running the local machine’s FireWall in ‘stealth’ mode. Normal/Standard FireWall setting (or OFF) solved that problem. In my situation the arps were coming from mDNS responses from networked printers. These arp bursts were tripping the security policy for arps/millisecond. Moderating the policy will be our solution.
Steve
Interesting – as of yesterday I’m seeing the same symptoms, but have no idea as to the cause. This is an Xserve running 10.4.11:
Dec 11 13:16:45: %SW_DAI-4-DHCP_SNOOPING_DENY: 1 Invalid ARPs (Req) on Po1, vlan 380.([000d.939d.679a/169.254.75.227/0000.0000.0000/128.180.41.1/13:16:44 EST Tue Dec 11 2007])
Dec 11 13:17:54: %SW_DAI-4-PACKET_RATE_EXCEEDED: 16 packets received in 469 milliseconds on Po1.
Dec 11 13:17:54: %PM-4-ERR_DISABLE: arp-inspection error detected on Gi1/0/37, putting Gi1/0/37 in err-disable state
Dec 11 13:17:54: %PM-4-ERR_DISABLE: arp-inspection error detected on Gi1/0/42, putting Gi1/0/42 in err-disable state
Dec 11 13:17:55: %LINEPROTO-5-UPDOWN: Line protocol on Interface Port-channel1, changed state to down
Dec 11 13:17:56: %LINK-3-UPDOWN: Interface Port-channel1, changed state to down
- You must be logged in to reply to this topic.