So, 192.168.1.204 device is broadcasting, "Who has 192.168.1.10? Tell 192.168.1.204"
I understand this.
I see no packet where 192.168.1.10 returns to 192.168.1.204
I understand that it night be directly to 192.168.1.204; and I might not see it.
But why does 192.168.1.204 ask so many times?
Seem like 192.168.1.10 is either not answering or 192.168.1.204 is sending way to many requests.
Because it wants to send a packet to 192.168.1.10, and therefore needs to know its MAC address, but, for whatever reason, 192.168.1.10 isn't responding with its MAC address, and neither is any other device on that LAN segment, so it keeps trying in the hopes that eventually somebody will respond.
That's how ARP works.
I suggest you figure out what's wrong with 192.168.1.10. If what's wrong with it is that it doesn't exist any more, you need to figure out why 192.168.1.204 is trying to send it packets and fix that.
answered 15 Feb, 17:11
Guy Harris ♦♦
The ARP requests are send with a frequency of 1 per second. This is usually an indicator, that the ARP request was never answered.
You might want to check the configuration, if 192.168.1.10 is referenced somewhere as DVR, gateway, DNS server, time server or somewhere else in the configuration. Please note, that certain parameters might be set a DHCP server.
To understand the situation you need a trace file from the point of view of 192.168.1.204. As Guy Harris pointed out, this requires a hub or a SPAN port.
answered 17 Feb, 11:30