ARP-table with MAC-address 00 00 00 00 00 00

From: Kurt Glazemakers (
Date: Tue May 09 2000 - 10:59:47 EST


I'm writing a tool for network topology discovery, based on SNMP. I
installed the UCD-SNMPd on my Linux-routers, because I want to read the
ARP-table of the different routers, to get a list of connected hosts. The
SNMPd reads the /proc/net/arp table to get his information. Because an
IP-address is only active in the ARP-table for a small period of time, I
first send an ICMP-packet to all the possible IP-addresses and then I
check the ARP-table.

The problem is that in Linux also non-active IP-addresses show up in the
ARP-table with MAC-address equal to zero. (See the example at the end of
this mail) This causes a rather big delay using the SNMP-protocol. We also
have a Cisco 7500 router, and there you only get the active IP-addresses
and their MAC-addresses (all different from zero)

Is there an option to avoid this large ARP-tables, or is where do I have
to change the kernel source ??

Thanks for your help,

Kurt Glazemakers

Example of a large ARP-table

IP address HW type Flags HW address Mask
Device 0x1 0x0 00:00:00:00:00:00 *
eth0 0x1 0x2 08:00:20:86:DB:B8 *
eth0 0x1 0x2 00:50:BA:C3:79:1C *
eth0 0x1 0x0 00:00:00:00:00:00 *
eth0 0x1 0x2 00:80:C8:C9:65:51 *
eth0 0x1 0x2 08:00:20:93:BF:63 *
eth0 0x1 0x0 00:00:00:00:00:00 *
eth0 0x1 0x0 00:00:00:00:00:00 *
eth0 0x1 0x0 00:00:00:00:00:00 *
eth0 0x1 0x2 08:00:20:93:C6:C2 *

To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to
Please read the FAQ at

This archive was generated by hypermail 2b29 : Mon May 15 2000 - 21:00:13 EST