How to troubleshoot gratuitous ARP ?

[Patrick150781]

Dear CheckMates,

I need to troubleshoot gratuitous ARP since on router does not get as soon as a cluster failover happend in an activ/passiv cluster without vMAC enabled.

Is is possible and will this command work?

tcpdump -i bond0.xxxx broadcast and arp and arp[6:2] == 2

Or does anyone of you has another usfull command?

Gateway is running with R81.10 Take 79

BR

Patrick

[the_rock]

You can even do tcpdump -i if_name arp...example tcpdump -i eth2 arp

Also, cppcap -f "arp" works too.

This website my colleague made ages ago is really good reference for multiple vendors:

https://tcpdump101.com/#

Cheers.

[_Val_]

If you have a suspicion G-ARPs are not sent, it is best to snoop them on the receiving end, not on your cluster member. 

[Chris_Atkinson]

The following discussion may also be helpful for you:

https://community.checkpoint.com/t5/Security-Gateways/How-to-send-G-ARP-manually/td-p/69895