I have a network capture that has excessive ARP traffic in it. It averages 150 to 250 ARP requests per second. The requests are cycling through all of the addresses on the subnet (255.255.254.0) in a random order. The Ethernet II data shows the destination as a broadcast but the ARP details show the target as a specific invalid MAC address instead of all zeros. All of the packets are to one of about 10 different invalid target MAC addresses regardless of the target IP address. I would appreciate any information or reference material. I could only find information related to ARP responses with an invalid MAC. Is this normal operation for some hardware? No. Time Source Destination Protocol Length Info asked 05 Aug '11, 11:47  Vicbug643839032 |
One Answer:
Excessive ARP requests on the magnitude that you observe are usually a sign of bad news. Within certain intervals an ARP sweep may be caused a few regular tasks, for example:
This is usually a "one and done" pattern. The target MAC address for an ARP request is set to zero for many IP implementations. However, certain systems don't zero the transmit buffers and send out some slag. Other systems put there the address that is already in their buffer when they confirm the validity of the ARP cache. I am somewhat riddled by the Procurve source address:
What happens after the switch receives an ARP response? Do you see any packets send to the target system? Good hunting! answered 05 Aug '11, 12:05  packethunter |
