Meaning of ARP operation code 3072

  • 22 January 2018
  • 4 replies

Userlevel 3
On an S-Series chassis we receive the following log messages:

RtrArpProc[1]Received ARP packet with Operation code: 3072

All I can find is the RFC stating that 3072 is in the unassigned range....

Does anyone have an idea what that message could mean?

4 replies

Userlevel 3
Thanks guys. As this is a Layer2 switch, my guess is that the ARP messages are coming from the default-gw for the VLAN where the switches are inside for management. Which is a Fortinet Firewall. But we will run a packet sniffer as soon as we find a free minute... will keep you updated.
Userlevel 4
I have checked our database and there is no related bug on this message so Dan is correct, chasing down that end station would really help.
Userlevel 3
That's a good question, will need to run a packet sniffer to find out...
Userlevel 4
The message is reporting that option code 3072 was set in an arp the device received.
I have not been able to find any information on this option other than what you have pointed out. What is the end device that sent the arp? That may give us a clue.