topic Re: arping responses not showing on newer appliances in General Topics

arping responses not showing on newer appliances

Paul_Hagyard — Wed, 01 Oct 2025 03:32:47 GMT

We have noticed with newer appliances (standard cluster members, not VSX or Maestro) that we do not get a response to "arping" requests as we do with older appliances, open servers, and CG IaaS on VMware. The issue is present for both standard and bond interfaces. We are definitely getting a response as running a tcpdump in another window for ARP traffic for the address in the arping command shows the reply.

We use arping extensively for simple connectivity testing (ping is often blocked by firewalls), has anyone else seen this or have any workarounds? The tcpdump approach is a pretty ugly workaround as it needs another command (in another window or as a background task) for each arping.

Cheers

Re: arping responses not showing on newer appliances

the_rock — Wed, 01 Oct 2025 05:06:12 GMT

Interesting... any specific model?

Andy

Re: arping responses not showing on newer appliances

Timothy_Hall — Wed, 01 Oct 2025 12:08:42 GMT

Code version? The Gaia kernel has been updated numerous times in recent releases, and arping may have been touched by those updates as it is a Linux utility.

Re: arping responses not showing on newer appliances

the_rock — Wed, 01 Oct 2025 12:11:39 GMT

That could be, for sure. I had not seen this on new 3920 models though.

Andy

Re: arping responses not showing on newer appliances

Bob_Zimmerman — Wed, 01 Oct 2025 15:23:05 GMT

When you say you don't get a response, what exactly do you mean? As you said, you must be getting ARP replies, otherwise traffic wouldn't work. Is the arping command telling you it got no responses?

[Expert@DallasSC]# arping -I eth1 -c 1 10.0.1.252 ARPING 10.0.1.252 from 10.0.1.251 eth1 Unicast reply from 10.0.1.252 [00:12:C1:10:01:FC] 0.802ms Sent 1 probes (1 broadcast(s)) Received 1 response(s) [Expert@DallasSC]# cpinfo -y all 2>&1 | grep JUMBO_HF_MAIN | uniq HOTFIX_R82_JUMBO_HF_MAIN Take: 41 BUNDLE_R82_JUMBO_HF_MAIN Take: 41

Re: arping responses not showing on newer appliances

the_rock — Wed, 01 Oct 2025 15:25:40 GMT

I just did tcpdump -enni any arp in my lab and gave results. Not sure what was exact command ran by @Paul_Hagyard , but even any arp command I did was fine too.

Andy

Re: arping responses not showing on newer appliances

Paul_Hagyard — Thu, 02 Oct 2025 19:46:12 GMT

Correct, arping shows no responses but tcpdump shows the reply is seen.

Seen on 9100 Plus appliances.

Re: arping responses not showing on newer appliances

the_rock — Thu, 02 Oct 2025 19:53:19 GMT

What about just arp or arp -a?

Andy

Re: arping responses not showing on newer appliances

Paul_Hagyard — Thu, 02 Oct 2025 19:55:13 GMT

Couple of screenshots attached, one showing arping with no responses when ping is working (allowed by the policy in this case), the second showing arping with no responses when tcpdump confirms that the ARP replies were received.

Re: arping responses not showing on newer appliances

Paul_Hagyard — Thu, 02 Oct 2025 19:56:07 GMT

R81.20 JHF 105

Re: arping responses not showing on newer appliances

Paul_Hagyard — Thu, 02 Oct 2025 19:56:51 GMT

I've only noticed it on 9100 Plus appliances so far.

Re: arping responses not showing on newer appliances

the_rock — Thu, 02 Oct 2025 19:59:28 GMT

Odd...just tried in the lab, even R82 has same issue.

Andy

Re: arping responses not showing on newer appliances

Paul_Hagyard — Thu, 02 Oct 2025 20:01:45 GMT

Those are both passive, so you need to ping first (or something) to generate an ARP request then check the arp table (arp -an). arping is a quick way to confirm that all the devices you could see before (e.g. platform migration) are still visible after.

Re: arping responses not showing on newer appliances

Bob_Zimmerman — Thu, 02 Oct 2025 20:09:08 GMT

That's bizarre. I would open a TAC case at this point. arping definitely works in general on Check Point's software.

Might be a quirk with the 9100. I don't have one to test to be sure, but I doubt that's it. Check Point's branded hardware is pretty vanilla amd64 gear, just with weird, proprietary card slots. It's normal enough you can run Windows on it.

Re: arping responses not showing on newer appliances

the_rock — Thu, 02 Oct 2025 20:17:35 GMT

Just tried on customer's 6200, same issue.

Andy

Re: arping responses not showing on newer appliances

Paul_Hagyard — Thu, 02 Oct 2025 20:46:18 GMT

Same behaviour on 9300 Plus with R82 JHF 39

Re: arping responses not showing on newer appliances

the_rock — Thu, 02 Oct 2025 20:51:36 GMT

I would open TAC case for this.

Andy

Re: arping responses not showing on newer appliances

_Val_ — Fri, 03 Oct 2025 09:34:40 GMT

Please open a TAC case for this

Re: arping responses not showing on newer appliances

Paul_Hagyard — Sun, 05 Oct 2025 21:38:15 GMT

I've raised a SR and the latest response included:
"The R&D team is actively working on it under case ID TM-89261."

Re: arping responses not showing on newer appliances

the_rock — Sun, 05 Oct 2025 21:41:57 GMT

Thanks for letting us know, Paul.

Andy