How can I monitor ARP?

Description

ARP (Address Resolution Protocol) maps layer 3 (IP addresses) to layer 2 (physical or MAC addresses) to enable communications between hosts residing on the same subnet. ARP is a broadcast protocol that can create excessive amounts of network traffic on your network. To minimize the broadcast traffic, an ARP cache is maintained to store and reuse previously learned ARP information.

Cause

L2 loops, ARP floods, 802.1q mismatch, subnet mask mismatch, etc. 


Resolution

NOTE: Admin would need to enable different features like AppFlow Monitor or MAC-IP Anti-Spoof.

  1. MONITOR | Real-Time Charts | Protocol Monitor | ARP RATE
    Image

  2. NETWORK | System | ARP | ARP Cache | Statistics
    Image

  3. NETWORK | System/MAC IP Anti-spoof | Anti-spoof Cache | Statistics
    Image

  4. NETWORK | System/MAC IP Anti-spoof | Spoof Detected List
    Image

  5. MONITOR | Logs | System Logs  and Filter by keyword "ARP"
    Image

  6. MONITOR | Tools & Monitors | Core0 Processes, and search for arp tasks usage
    Image

  7. Using the Packet Monitor follow the link Diagnose your network topology with SonicWall built-in Packet Monitor (layer 2 loops)

Related Articles

  • Ports, FQDNs and IP Addresses Used by SonicWall Products
    Read More
  • How can I calculate supported maximum PPS (Packets Per Second) of UTM appliance?
    Read More
  • SonicWall ファイアウォールにおける Credential Auditor (資格情報監査)の理解と活用
    Read More
not finding your answers?