Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Diagnostics ARP Table 504 Nginx Gateway Timeout

    Scheduled Pinned Locked Moved General pfSense Questions
    61 Posts 5 Posters 10.1k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • M
      manicmoose
      last edited by

      Think I've "solved" it. ๐Ÿค”

      ntopng seems to be the culprit - I disabled it and all the ARPs have stopped. I haven't modified ntopng in ages, so maybe the config has become corrupted and it's doing something it's not supposed to be. Odd one.

      I'll wait awhile before re-enabling it, but I will delete the data/config and re-install it fresh to ensure it's happier than it was.

      Barring another re-occurance, thanks for the help folks!

      johnpozJ 1 Reply Last reply Reply Quote 0
      • johnpozJ
        johnpoz LAYER 8 Global Moderator @manicmoose
        last edited by johnpoz

        @manicmoose said in Diagnostics ARP Table 504 Nginx Gateway Timeout:

        ntopng seems to be the culprit

        While I don't profess to being a ntop guru by any means.. I don't get why it would be arping like that. I get what your saying that it stopped what your seeing - but not sure why it do that.. Ntop out of the box sure shouldn't be arping every IP for networks its attached too..

        An intelligent man is sometimes forced to be drunk to spend time with his fools
        If you get confused: Listen to the Music Play
        Please don't Chat/PM me for help, unless mod related
        SG-4860 24.11 | Lab VMs 2.8, 24.11

        M 1 Reply Last reply Reply Quote 0
        • M
          manicmoose @johnpoz
          last edited by

          @johnpoz Agreed - and it never used to, which is why I think it's become a little confused...

          Time to reset its brain when I re-enable it (later).

          1 Reply Last reply Reply Quote 0
          • stephenw10S
            stephenw10 Netgate Administrator
            last edited by

            It will it you have enabled this:

            Active Network Discovery
            
            Toggle the periodic discovery of network devices using multiple techniques that include ARP scan, MDNS and SSDP.
            

            That's not enabled by default.

            johnpozJ 1 Reply Last reply Reply Quote 0
            • johnpozJ
              johnpoz LAYER 8 Global Moderator @stephenw10
              last edited by

              Nor should it be enabled on your wan interface ;)

              An intelligent man is sometimes forced to be drunk to spend time with his fools
              If you get confused: Listen to the Music Play
              Please don't Chat/PM me for help, unless mod related
              SG-4860 24.11 | Lab VMs 2.8, 24.11

              1 Reply Last reply Reply Quote 0
              • M
                manicmoose
                last edited by

                Yep, I get all that.

                As mentioned, I hadn't altered the ntopng config for ages, so I don't think that was it - but I've blown away the config now so I can't check.

                Nevertheless, it's solved so that's all I care about. ๐Ÿ‘Œ

                L 1 Reply Last reply Reply Quote 0
                • L
                  lddj9090 @manicmoose
                  last edited by

                  @manicmoose
                  Thanks for the information, unfortunately wasn't able to check in for a week.

                  I have uninstalled ntopng, but still got a long waiting time to see the ARP entries. Will do a tcpdump to check further.

                  johnpozJ L 2 Replies Last reply Reply Quote 0
                  • johnpozJ
                    johnpoz LAYER 8 Global Moderator @lddj9090
                    last edited by

                    did flush the cache? The items would still be there for 20 minutes even if you uninstall what was arping for them.

                    An intelligent man is sometimes forced to be drunk to spend time with his fools
                    If you get confused: Listen to the Music Play
                    Please don't Chat/PM me for help, unless mod related
                    SG-4860 24.11 | Lab VMs 2.8, 24.11

                    1 Reply Last reply Reply Quote 0
                    • L
                      lddj9090 @lddj9090
                      last edited by

                      @lddj9090
                      How can i clear the arp cache on pfsesne, all at once?

                      1 Reply Last reply Reply Quote 0
                      • L
                        lddj9090 @johnpoz
                        last edited by

                        @johnpoz

                        2-5 minutes.

                        johnpozJ 1 Reply Last reply Reply Quote 0
                        • johnpozJ
                          johnpoz LAYER 8 Global Moderator @lddj9090
                          last edited by

                          arp -d -a

                          or from the gui click the clear arp table.

                          An intelligent man is sometimes forced to be drunk to spend time with his fools
                          If you get confused: Listen to the Music Play
                          Please don't Chat/PM me for help, unless mod related
                          SG-4860 24.11 | Lab VMs 2.8, 24.11

                          L 1 Reply Last reply Reply Quote 0
                          • L
                            lddj9090 @johnpoz
                            last edited by

                            @johnpoz

                            Cleared the cache and tried again, still spinning for ages and timeout. Could "snort" be somehow involved?

                            johnpozJ 1 Reply Last reply Reply Quote 0
                            • johnpozJ
                              johnpoz LAYER 8 Global Moderator @lddj9090
                              last edited by

                              You need to figure out why your wan has anything it.. Have gone over why there should be nothing in your wan network in your arp cache other than your gateway..

                              NOTHING should just be arping for every IP on a network.. especially our wan.. So there is something you set to arp, or some other reason.

                              You need to sniff on your wan and figure out what - are you arping, is it gratuitous arps? etc..

                              Out of the box pfsense with any package installed shouldn't be arping neither your wan network your lan side networks.. It would have to be some setting you did.. Like the ntop setting for network discovery.

                              An intelligent man is sometimes forced to be drunk to spend time with his fools
                              If you get confused: Listen to the Music Play
                              Please don't Chat/PM me for help, unless mod related
                              SG-4860 24.11 | Lab VMs 2.8, 24.11

                              L 1 Reply Last reply Reply Quote 0
                              • L
                                lddj9090 @johnpoz
                                last edited by

                                @johnpoz
                                Alright, I will investigate further and talk back to you later. Thanks for the support so far!

                                stephenw10S 1 Reply Last reply Reply Quote 0
                                • stephenw10S
                                  stephenw10 Netgate Administrator @lddj9090
                                  last edited by

                                  @lddj9090 Do you actually have WAN side ARP entries with public IPs?

                                  Are they eventually being resolved by reverse DNS?

                                  Could a completely different problem than @manicmoose had.

                                  Steve

                                  L 1 Reply Last reply Reply Quote 0
                                  • jimpJ
                                    jimp Rebel Alliance Developer Netgate
                                    last edited by

                                    Last time someone was seeing ARP for random hosts on WAN it was from having their subnet mask on the WAN interface set to something ridiculous like 0 instead of what it should have been (e.g. 24, 29, etc.)

                                    If your WAN is set to a static address, double check your IP address and subnet mask settings.

                                    Whatever is upstream may be answering ARP for anything with its own MAC. That's unusual but not unheard of.

                                    Remember: Upvote with the ๐Ÿ‘ button for any user/post you find to be helpful, informative, or deserving of recognition!

                                    Need help fast? Netgate Global Support!

                                    Do not Chat/PM for help!

                                    L 1 Reply Last reply Reply Quote 0
                                    • L
                                      lddj9090 @stephenw10
                                      last edited by

                                      @stephenw10

                                      As far as I am aware, there aren't any public IP in my ARP output.

                                      Here is a snippet of the ARP -a output: arp_snippet_pfsense.txt

                                      We do have high availability sync enabled. As well as a bunch of Virtual IPs (CARP). Even though they all seem to be configured correctly, could that cause something unexpected?

                                      1 Reply Last reply Reply Quote 0
                                      • L
                                        lddj9090 @jimp
                                        last edited by

                                        @jimp

                                        I double-checked the WAN Interfaces static address settings, they are all setup correctly.

                                        2c157b07-369d-4874-b3d5-8248069b797f-image.png

                                        johnpozJ 1 Reply Last reply Reply Quote 1
                                        • johnpozJ
                                          johnpoz LAYER 8 Global Moderator @lddj9090
                                          last edited by

                                          And how many entries in your arp table? 1000's ??

                                          An intelligent man is sometimes forced to be drunk to spend time with his fools
                                          If you get confused: Listen to the Music Play
                                          Please don't Chat/PM me for help, unless mod related
                                          SG-4860 24.11 | Lab VMs 2.8, 24.11

                                          L 1 Reply Last reply Reply Quote 0
                                          • L
                                            lddj9090 @johnpoz
                                            last edited by

                                            @johnpoz
                                            254

                                            johnpozJ 1 Reply Last reply Reply Quote 0
                                            • First post
                                              Last post
                                            Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.