Re: Why so much ARP traffic?

Tech-Archive recommends: Repair Windows Errors & Optimize Windows Performance

Phillip Windell wrote:
"Kurt" <kurtl@xxxxxxxxxxxxxxxxx> wrote in message news:12pgohecjinpq23@xxxxxxxxxxxxxxxxxxxxx
It only happens once, doesn't it? Whenever I bring a new server on-line for the first time it sets off alarms, probably because sequential ARPs are interpreted as a precursor to some kind of attack (I've never bothered sniffing it because it happens every time). I believe it also attempts some snmp discovery. Under normal situations, ARPs should only happen when an IP address that's not in the local ARP cache is being contacted. If it is persistent, try killing processes in task manager until you find the offending one.

ARP caches have a short life span,..so as far as I know it is very common, and normal, to see lots and lots of ARP requests all the time.

Seems to be continuous. Each address being asked to respond and there are hundreds of possible addresses.

So this is normal and I should not worry about all this traffic?

Jeanette
.

Relevant Pages

  • Re: switch jamming
    ... There are two widely-understood ways to make a switch send traffic your ... The other is to poison the ARP cache of one or more ... that people are referring to the MAC address cache rollover attack ...
    (Vuln-Dev)
  • Re: misc/148463: [arp] ARP cache can be poisoned or polluted with ease.
    ... Subject: misc/148463: [arp] ARP cache can be poisoned or polluted with ... itigate some of the risk associated with the cache poison issue. ... What about the ARP cache pollution issue? ... tential issues with how FreeBSD implemented the ARP cache. ...
    (freebsd-net)
  • Re: MSCS - arp cache/mac-address problems
    ... No the ARP cache should be updated once the virutal server fails over. ... should assume part of the phyical NIC MAC and part virtual. ...
    (microsoft.public.windows.server.clustering)
  • Re: Default route doesnt change to wireless device (ath0)
    ... quite the opposite - a link state change is is when you REALLY want ... state (particularly ARP) to be flushed. ... ARP cache should _always_ flush on link ...
    (freebsd-current)
  • Re: Stopping Arp poison attacks
    ... I now understand that Dynamic ARP inspection can prevent this technique in most cases. ... However, this is vendor specific, and not every customer uses Cisco. ... Some Cisco switches like the 2950 for instance do not offer DAI. ... between a MAC address and an IP address in ARP cache. ...
    (Pen-Test)