瞻博网络 ARP 表最大限制

网络工程 杜松 MAC地址 arp 瞻博网络
2021-07-28 14:30:05

我正在运行EX3300-48T - Junos-12.3R11.2在同一台交换机的多个vlan上绑定多个/24后,开始发现新旧分配的IP在不同端口的多台服务器上ping不通。

我查了ARP表show arp no-resolve,不是所有的IP都在那里,所以我清理了ARP表clear arp,大部分IP又开始响应了。

# run show arp no-resolve | match entries无论我们做什么,都不会超过4017的限制

username@juniper# run show arp no-resolve | match entries    
Total entries: 3971

然后我搜索了这个范围:192.168.1.0/24,分配给它的服务器宕机了

username@juniper# run show arp no-resolve | match 192.168.1    
{master:0}[edit]

然后再次启动服务器,数量上升到相同的限制4017

username@juniper# run show arp no-resolve | match entries    
Total entries: 4017
{master:0}[edit]

并且显示了一些IP

username@juniper# run show arp no-resolve | match 192.168.1 
macaddress 192.168.1.9       vlan.131             none
macaddress 192.168.1.13      vlan.131             none
macaddress 192.168.1.29      vlan.131             none
macaddress 192.168.1.42      vlan.131             none
macaddress 192.168.1.54      vlan.131             none
macaddress 192.168.1.81      vlan.131             none
macaddress 192.168.1.91      vlan.131             none
macaddress 192.168.1.103     vlan.131             none
macaddress 192.168.1.104     vlan.131             none
macaddress 192.168.1.116     vlan.131             none
macaddress 192.168.1.140     vlan.131             none
macaddress 192.168.1.156     vlan.131             none
macaddress 192.168.1.179     vlan.131             none
macaddress 192.168.1.193     vlan.131             none
macaddress 192.168.1.199     vlan.131             none
macaddress 192.168.1.201     vlan.131             none
macaddress 192.168.1.227     vlan.131             none
macaddress 192.168.1.239     vlan.131             none
macaddress 192.168.1.244     vlan.131             none

ARP统计

show system statistics arp 
fpc0:
--------------------------------------------------------------------------
arp:
149291335 datagrams received
33571473 ARP requests received
108007342 ARP replies received
342919782 resolution request  received
0 unrestricted proxy requests
0 restricted proxy requests
0 received proxy requests
0 unrestricted proxy requests not proxied
0 restricted proxy requests not proxied
0 datagrams with bogus interface
0 datagrams with incorrect length
0 datagrams for non-IP protocol
0 datagrams with unsupported op code
0 datagrams with bad protocol address length
0 datagrams with bad hardware address length
0 datagrams with multicast source address
147499 datagrams with multicast target address
0 datagrams with my own hardware address
1342124 datagrams for an address not on the interface
274 datagrams with a broadcast source address
1404642 datagrams with source address duplicate to mine
1242680 datagrams which were not for me
2788 packets discarded waiting for resolution
125 packets sent after waiting for resolution
1818267175 ARP requests sent
33571474 ARP replies sent
0 requests for memory denied
0 requests dropped on entry
0 requests dropped during retry
0 requests dropped due to interface deletion
0 requests on unnumbered interfaces
0 new requests on unnumbered interfaces
0 replies for from unnumbered interfaces
0 requests on unnumbered interface with non-subnetted donor
0 replies from unnumbered interface with non-subnetted donor
0 arp packets rejected as family is configured with deny arp
0 arp response packets are rejected on mace icl interface
1634 arp replies are rejected as source and destination is same
0 arp probe for proxy address reachable from the incoming interface
0 arp request discarded for vrrp source address
0 self arp request packet received on irb interface
0 proxy arp request discarded as source ip is a proxy target
71669 arp packets are dropped as nexthop allocation failed
0 arp packets received from peer vrrp rotuer and discarded
0 arp packets are rejected as target ip arp resolve is in progress
0 grat arp packets are ignored as mac address is not changed
0 arp packets are dropped from peer vrrp
3501998 arp packets are dropped as driver call failed
0 arp packets are dropped as source is not validated

它被限制为 4017 的概率是多少?我们不应该期望至少 3971+254=4225 条目,而不是 4017 并且该范围内的其他 IP 应该出现吗?如果是有限的,如何提高?

谢谢,

1个回答

根据数据表,EX3300 限制为 4000 个 ARP 条目。看起来这是硬件限制;无法像在 Cisco IOS 中那样加载不同的“SDM 模板”,因此您被困在这个数字上。

如果您有一个非常动态的网络,您可以尝试减少ARP 老化计时器,以更快地老化过时的 ARP 条目:

system {
    arp {
        aging-timer 5;
    }
}

如果这没有帮助,您只能购买更大的开关;EX3400(EX3300 的后继产品)可以处理 16000 个 ARP 条目。