How can I monitor ARP?

Description

ARP (Address Resolution Protocol) maps layer 3 (IP addresses) to layer 2 (physical or MAC addresses) to enable communications between hosts residing on the same subnet. ARP is a broadcast protocol that can create excessive amounts of network traffic on your network. To minimize the broadcast traffic, an ARP cache is maintained to store and reuse previously learned ARP information.

Cause

L2 loops, ARP floods, 802.1q mismatch, subnet mask mismatch, etc. 


Resolution

NOTE: Admin would need to enable different features like AppFlow Monitor or MAC-IP Anti-Spoof.

  1. MONITOR | Real-Time Charts | Protocol Monitor | ARP RATE
    Image

  2. NETWORK | System | ARP | ARP Cache | Statistics
    Image

  3. NETWORK | System/MAC IP Anti-spoof | Anti-spoof Cache | Statistics
    Image

  4. NETWORK | System/MAC IP Anti-spoof | Spoof Detected List
    Image

  5. MONITOR | Logs | System Logs  and Filter by keyword "ARP"
    Image

  6. MONITOR | Tools & Monitors | Core0 Processes, and search for arp tasks usage
    Image

  7. Using the Packet Monitor follow the link Diagnose your network topology with SonicWall built-in Packet Monitor (layer 2 loops)

Related Articles

  • SonicOS 8.1.0 FAQ
    Read More
  • SonicWall GEN8 TZs and GEN8 NSas Settings Migration
    Read More
  • Getting started with SonicWall firewalls
    Read More
not finding your answers?