SNMP trap is partly destroyed during ARP execution in Windows

Symptoms

A partial datagram of a Simple Network Management Protocol (SNMP) trap cannot be sent and discarded when one or more of the following conditions are true:
  • Multiple IP addresses are registered as the SNMP sender.
  • No entries for the SNMP sender IP and MAC address in the Address Resolution Protocol (ARP) table.
  • An application issues many SNMP traps in a short time period.

Cause

This issue occurs because of Internet Host requirements that are defined in RFC1122 (Requirements for Internet Hosts -- Communication Layers). This is by design.
Specifically, when packets are sent to the IP address whose MAC address is unresolved by ARP, the data link layer will save at least one of the packets that are sent to the same unresolved IP address. Therefore, the saved packets will be sent to the IP address until the MAC address is resolved.

Workaround

To work around this issue, follow these steps:
  1. Before the SNMP trap is sent, update the ARP cache by running a ping command.
  2. Statically register next-hop IP address, such as the default gateway.

    Note This value is reset after the system is restarted.

More Information

About ARP caching behavior in Windows
Download the document about TCP/IP registry values for Windows Vista and for Windows Server 2008.

The third-party products that this article discusses are manufactured by companies that are independent of Microsoft. Microsoft makes no warranty, implied or otherwise, about the performance or reliability of these products.

Propriétés

ID d'article : 2840421 - Dernière mise à jour : 22 déc. 2014 - Révision : 1

Commentaires