I ran analysis on a pretty complex network so that I could find the reason that all workstations run slowly when connected to the LAN but ran fine when not connected. I plugged directly in to a switch and monitored the network traffic.
Upon analysis I found that one device(server) is consistently sending out ARP Broadcast over the network. It does this at intervals no higher than five seconds and often twice per one second intervals.
Since all machines must listen for this broadcast could this be the culprit in my bogged down network?
asked 08 Nov '11, 06:15
A good look at ARP packets can sometimes reveal interesting things about your network. One server sending out an ARP request every few seconds is not a big issue.
Here are a few items that I check when looking at ARP packets:
Wireshark helps in answering some of these questions. Here are a few helpful display filters:
Note that the filter in section 1 will show gratuitous ARPs issued by newer Windows systems. A sender IP address of 0.0.0.0 can safely be ignored (and specified in the filter).
Display filters could be shorter and more compact. The spelling here is chosen to make it easy to read and understand.
When just looking at the broadcast packet don't forget to check a couple of extra things:
answered 08 Nov '11, 08:36