Juniper 有没有办法避免大量的 ARP 请求?

网络工程 杜松 arp
2021-07-23 13:57:40

在我的 Juniper 路由器中,接口总是为一些未使用的 IP 地址发送 ARP 请求。

在此处输入图片说明

有什么问题吗?

以及瞻博网络是否有办法避免大量的 ARP 请求?

有这么多ARP请求正常吗?


编辑-01

在其他 Juniper 路由器中,还有另一个问题:

....
19:21:17.207967  In arp who-has 40.21.158.134 tell 40.21.158.129              
19:21:17.207987 Out arp reply 40.21.158.134 is-at d0:07:ca:0b:63:0c            
19:21:17.891603 Out arp who-has 40.17.42.132 tell 40.17.42.134                
19:21:18.807865 Out arp who-has 40.17.42.132 tell 40.17.42.134                
19:21:21.333322 Out arp who-has 40.17.42.133 tell 40.17.42.134                
19:21:22.256325 Out arp who-has 40.17.42.133 tell 40.17.42.134                
19:21:22.974378 Out arp who-has 40.17.42.133 tell 40.17.42.134                
19:21:23.581650 Out arp who-has 40.17.42.133 tell 40.17.42.134                
19:21:24.289537 Out arp who-has 40.17.42.133 tell 40.17.42.134                
19:21:25.393399 Out arp who-has 40.17.42.133 tell 40.17.42.134                
19:21:26.198545 Out arp who-has 40.17.42.133 tell 40.17.42.134                
19:21:27.106570 Out arp who-has 40.17.42.133 tell 40.17.42.134                
19:21:27.910819 Out arp who-has 40.17.42.133 tell 40.17.42.134                
19:21:28.511469 Out arp who-has 40.17.42.133 tell 40.17.42.134                
19:21:29.713391 Out arp who-has 40.17.42.133 tell 40.17.42.134                
19:21:30.317394 Out arp who-has 40.17.42.133 tell 40.17.42.134                
19:21:31.018756 Out arp who-has 40.17.42.133 tell 40.17.42.134                
19:21:31.530481 Out arp who-has 40.17.42.133 tell 40.17.42.134                
19:21:32.137657 Out arp who-has 40.17.42.133 tell 40.17.42.134                
19:21:33.699346 Out arp who-has 40.17.42.132 tell 40.17.42.134                
19:21:34.268401 Out arp who-has 40.17.42.132 tell 40.17.42.134                
19:21:35.186173 Out arp who-has 40.17.42.132 tell 40.17.42.134                
19:21:35.796321 Out arp who-has 40.17.42.132 tell 40.17.42.134                
19:21:36.407914 Out arp who-has 40.17.42.132 tell 40.17.42.134                
19:21:38.818351 Out arp who-has 40.17.42.131 tell 40.17.42.134                
19:21:38.935274 Out arp who-has 40.17.42.132 tell 40.17.42.134                
19:21:39.460692 Out arp who-has 40.17.42.131 tell 40.17.42.134                
19:21:39.663202 Out arp who-has 40.17.42.132 tell 40.17.42.134                
19:21:40.373898 Out arp who-has 40.17.42.132 tell 40.17.42.134                
19:21:40.375047 Out arp who-has 40.17.42.131 tell 40.17.42.134                
19:21:41.084739 Out arp who-has 40.17.42.131 tell 40.17.42.134                
19:21:41.084927 Out arp who-has 40.17.42.132 tell 40.17.42.134                
19:21:41.900625 Out arp who-has 40.17.42.132 tell 40.17.42.134                
19:21:42.003071 Out arp who-has 40.17.42.131 tell 40.17.42.134                
19:21:42.671415 Out arp who-has 40.17.42.133 tell 40.17.42.134                
19:21:43.422088 Out arp who-has 40.17.42.133 tell 40.17.42.134                
19:21:44.237351 Out arp who-has 40.17.42.133 tell 40.17.42.134                
19:21:44.800125  In arp who-has 40.21.158.134 tell 40.21.158.130              
19:21:44.800143 Out arp reply 40.21.158.134 is-at d0:07:ca:0b:63:0c            
19:21:44.843554 Out arp who-has 40.17.42.133 tell 40.17.42.134                
19:21:45.453770 Out arp who-has 40.17.42.133 tell 40.17.42.134                
19:21:47.853272 Out arp who-has 40.17.42.133 tell 40.17.42.134                
19:21:48.660676 Out arp who-has 40.17.42.133 tell 40.17.42.134                
19:21:49.460576 Out arp who-has 40.17.42.133 tell 40.17.42.134                
19:21:50.160462 Out arp who-has 40.17.42.133 tell 40.17.42.134                
19:21:50.760365 Out arp who-has 40.17.42.133 tell 40.17.42.134                
19:21:55.526428 Out arp who-has 40.17.42.133 tell 40.17.42.134                
19:21:56.314292 Out arp who-has 40.17.42.133 tell 40.17.42.134                
19:21:56.925603 Out arp who-has 40.17.42.133 tell 40.17.42.134                
19:21:57.638616 Out arp who-has 40.17.42.133 tell 40.17.42.134                
19:21:57.658446  In arp who-has 40.21.158.134 tell 40.21.158.129              
19:21:57.658466 Out arp reply 40.21.158.134 is-at d0:07:ca:0b:63:0c 
....

您在 处看到 Server( 40.21.158.129) ARP 请求19:21:17.207967,但它在 处再次请求19:21:57.658446我们知道ARP记录一般是2分钟,为什么请求这么频繁?

1个回答

这个问题很常见 - 地址40.17.42.133在您的网络中无法访问或已经无法访问,并且有其他主机试图通过您的路由器连接到它。

ARP 请求的数量和速率与发往目标地址的请求数量成正比 - 请注意,尝试连接的不是您的路由器,而是通过路由器的下游主机 - 您的路由器需要解析 MAC 地址虽然最终主机。在某些低端设备(想到 EX 虚拟机箱)上,这可能会成为问题,因为它会影响 RE CPU,因为每次新的 ARP 退出时,ARP 请求计时器都会在主 RE 和备用 RE 之间不断重新同步

您可以采取多种措施来阻止/限制这种情况:

  • 一个(假)静态 ARP 条目40.17.42.133会阻止 RE 连续请求地址,但如果再次使用该地址会导致问题。
  • 丢弃路由条目40.17.42.133也将停止 ARP 生成,但如上所述 - 将影响沿轨道的可达性
  • 防火墙过滤器阻止发往该地址的流量(这需要在入口端应用)
  • 入口端的 PCAP 确定哪些主机正在尝试连接到目标主机,然后修复它们(在规模上并不总是实用)