High ARP cache usage-juniper-junos

High ARP cache usage-juniper-junos

Vendor: juniper

OS: junos

Description:
Indeni will alert when the number of ARP entries stored by a device is nearing the allowed limit.

Remediation Steps:
Identify the cause of the large ARP table. If it is due to a legitimate cause, such as a high number of hosts visible on the available networks, please contact your technical support provider.

junos-show-arp-no-resolve

name: junos-show-arp-no-resolve
description: JUNOS get ARP table information
type: monitoring
monitoring_interval: 5 minute
requires:
  vendor: juniper
  os.name: junos
  product: firewall
comments:
  arp-total-entries:
    why: |
      A network device which forwards traffic needs to know the MAC addresses of devices it is directly connected to, so it can send traffic on layer 2.
      To do this, it uses ARP requests. The ARP replys are stored in a cache which allows the device to avoid doing ARP requests again and again for the same destination IP.
      The ARP cache has a finite size to avoid using up all of the available memory. If the ARP cache fills up with entries, some traffic may be dropped or drastically slowed down.
    how: |
      This script retrieves the information from the ARP table via SSH connection to the device by running the "show arp no-resolve" command.
    can-with-snmp: false
    can-with-syslog: false
  arp-table:
    why: |
      The ARP table stores the mapping between IPs and MAC addresses to minimize the ARP traffic.
      The size of the ARP table and the incorrect mapping between IPs and MAC addreses can create many different issues for the network. So it is critical to monitor it.
    how: |
      This script retrieves the information from the ARP table via SSH connection to the device by running the command  "show arp no-resolve" command.
      Then it extracts IPs, MAC addresses, interfaces and status. It also shows the total entries in the ARP table.
    can-with-snmp: true
    can-with-syslog: false
steps:
  -   run:
        type: SSH
        command: show arp no-resolve | display xml
      parse:
        type: XML
        file: show-arp-no-resolve.parser.1.xml.yaml

arp_neighbor_overflow

Failed to fetch the data: https://bitbucket.org/indeni/indeni-knowledge/src/master/rules/templatebased/crossvendor/arp_neighbor_overflow.scala