Meaning of ARP operation code 3072

  • 0
  • 1
  • Question
  • Updated 4 months ago
  • Answered
On an S-Series chassis we receive the following log messages:

RtrArpProc[1]Received ARP packet with Operation code: 3072

All I can find is the RFC stating that 3072 is in the unassigned range....

Does anyone have an idea what that message could mean?
Photo of Carsten Buchenau

Carsten Buchenau

  • 888 Points 500 badge 2x thumb

Posted 4 months ago

  • 0
  • 1
Photo of Daniel Coughlin

Daniel Coughlin, Employee

  • 2,608 Points 2k badge 2x thumb
The message is reporting that option code 3072 was set in an arp the device received.
I have not been able to find any information on this option other than what you have pointed out.  What is the end device that sent the arp?  That may give us a clue.
Photo of Carsten Buchenau

Carsten Buchenau

  • 888 Points 500 badge 2x thumb
That's a good question, will need to run a packet sniffer to find out...
Photo of Jason Parker

Jason Parker, Employee

  • 2,898 Points 2k badge 2x thumb
I have checked our database and there is no related bug on this message so Dan is correct, chasing down that end station would really help.
Photo of Carsten Buchenau

Carsten Buchenau

  • 888 Points 500 badge 2x thumb
Thanks guys. As this is a Layer2 switch, my guess is that the ARP messages are coming from the default-gw for the VLAN where the switches are inside for management. Which is a Fortinet Firewall. But we will run a packet sniffer as soon as we find a free minute... will keep you updated.