What causes continuous arp requests with same IP?

ARP
storm

asked 2018-03-09 16:03:03 +0000

thebeezle
1 ●1 ●1 ●1

Is there a reason why a device would send an arp storm (15-20/sec) of arp requests for it's own IP? I'm reluctant to call it a 'storm' but it seems excessive. Is it merely trying to see if there is a duplicate IP of itself on the network? The MAC address is a Wibhu Tech device which I believe is some kind of WiFi access point. thx

10:51:31.014032 ARP, Ethernet (len 6), IPv4 (len 4), Request who-has 192.168.1.195 (Broadcast) tell 192.168.1.195, length 46
10:51:31.090023 ARP, Ethernet (len 6), IPv4 (len 4), Request who-has 192.168.1.195 (Broadcast) tell 192.168.1.195, length 46

edit retag flag offensive close merge delete

add a comment

1 Answer

Sort by » oldest newest most voted

answered 2018-03-10 22:24:41 +0000

Christian_R

2059 ●9 ●71 ●51 http://crnetpackets.com

Seems, that device is sending out continously an Gratious ARP Request. Either you got a loop on your network or maybe someone is spoofing this IP Address.

But in fact this is not a normal behaviour and if I where you I would investigate this behaviour.

edit flag offensive delete link

Comments

I encountered similar issues. Could you advise how to investigate this behavior?

YHC ( 2021-02-28 04:18:16 +0000 )edit

add a comment

Your Answer

Please start posting anonymously - your entry will be published after you log in or create a new account.

Add Answer

Question Tools

1 follower

Stats

Asked: 2018-03-09 16:03:03 +0000

Seen: 2,050 times

Last updated: Mar 10 '18

What causes continuous arp requests with same IP? edit