> Source: [sk182544](https://support.checkpoint.com/results/sk/sk182544)

# sk182544 - Output of the "arp -an" command shows duplicate entries

| Property | Value |
|----------|-------|
| Solution ID | sk182544 |
| Date Created | 2024-08-01 |
| Last Modified | 2025-01-15 |
| Technical Level | Advanced |
| Products | Security Gateway, Scalable Platforms |
| Versions | R82, R81.20, R81.10 (EOS), R81 (EOS), R82, R81.20, R81.10 (EOS), R81 (EOS) |
| OS | Gaia |

## Symptoms

- * The "`arp -an | uniq -D`" command shows some entries two times.

  Each run of this command may show different duplicate entries.
* The "`asg_arp --verify`" command (on Scalable Platforms) does not show these duplicate entries.

  However, it reports inconsistencies in MAC addresses between the Security Group Members.

  Manual verification shows that the reported inconsistent MAC address entries are identical on the Security Group Members.
* The "`ip neigh show | uniq -D`" command does not show these duplicate entries.

* The `/var/log/messages` file does not contain the "`Neighbour table overflow`" error.

## Cause

It is an expected behavior.

The "`arp`" command retrieves the ARP cache directly from the Linux kernel.

The Linux kernel exposes this cache through the "`/proc/net/arp`" file that is not locked during the read operation.

When the "`arp`" command is executed, it captures a snapshot of the "`/proc/net/arp`" file. If the ARP cache size exceeds the buffer capacity during the read, some entries may appear duplicated.

## Solution

This solution requires authentication. Please log in to view the full solution.

---

# Agent Instructions

This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products.

## Navigating This Knowledge Base

- **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt)
- **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml)
- **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}`
- **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content