Dead client ARP?

[Pericynthion]

Hi Merlin,

I was trying to troubleshoot a local LAN problem with wireshark and I noticed a large number of ARP requests coming from the AC66U. Whilst I know this is part of the normal routine for L3/L2 communications, the thing I find odd is that they are for non-active IP addresses.

I confirmed that there is no DHCP lease active (the address nor client MAC doesn't appear in the DHCP log), as it expired a few days ago (it was active >48hrs ago, but I only have a 24hr lease).
However I can see the client name, MAC and IP details in the 'client list' screen on the network map - as if it was still an active client.

I was trying to troubleshoot further (to see if there were some remnant uPNP ports to that address or something), but the router reset itself whilst I was inspecting the Netstat ports. I guess if you have a very dynamic network this would quickly build up the traffic to any 'dead' addresses (I had 3 dead addresses being actively ARP'd, and I only peak at around 25 clients connected).

I'll keep an eye on it to see if I can gather further info - but it looks like clients are not aging out of the client list even after the DHCP lease has expired. Not sure why the ARP is coming from the router (confirmed it was the source MAC) unless its something to do with name resolution in the client list page.

p.s. Thanks again for all your great work Merlin!

 

[Pericynthion]

I just found the other thread about the client list updating - explaining that entries in the client list are there because they are in the ARP cache.

Makes sense - but I thought the standard arp cache timeout was around 10 or 20 mins, so I'm a but confused why they dont appear to be aging out.

I guess if something else is processing based on the contents of the ARP cache, then that would explain why I'm seeing the requests.

 

[RMerlin]

The networkmap service isn't a "realtime" display. You have to hit the Refresh button for networkmap to rebuild the list it will present as the Client List, otherwise it will just display what it has cached from the last network scan.

 

[highwire]

I was trying to troubleshoot a local LAN problem with wireshark and I noticed a large number of ARP requests coming from the AC66U. Whilst I know this is part of the normal routine for L3/L2 communications, the thing I find odd is that they are for non-active IP addresses.

I'm also having some interesting issues with the client list. All of my IP addresses are statically defined. I sometimes get the same IP address repeated more than once, sometimes with different client names, sometimes with the same names. Sometimes I get a valid IP address listed with the wrong client name or MAC address. I can't seem to find a pattern to the weirdness.

 

[RMerlin]

I'm also having some interesting issues with the client list. All of my IP addresses are statically defined. I sometimes get the same IP address repeated more than once, sometimes with different client names, sometimes with the same names. Sometimes I get a valid IP address listed with the wrong client name or MAC address. I can't seem to find a pattern to the weirdness.

Got any device name that are exactly 15 characters long? There was a bug caused by these that is currently fixed in the development version.

 

[highwire]

Got any device name that are exactly 15 characters long? There was a bug caused by these that is currently fixed in the development version.

Hmm, as a matter of fact, I have several names that are exactly 15 characters long. I will change them and see if that helps. Thanks.

 

[RMerlin]

Hmm, as a matter of fact, I have several names that are exactly 15 characters long. I will change them and see if that helps. Thanks.

This is most likely the reason then. That bug has been fixed a few weeks ago.