What Would Cause a Lot of ARP Broadcasts From One System / Machine

by nixCraft on March 27, 2008 · 2 comments· last updated at March 27, 2008

Q. I'm experiencing decreased network performance due to ARP broadcasts coming from one system. What would cause a lot of ARP broadcasts from one server / computer?

A. ARP convers a 32 bit IP address into a 48-bit Ethernet address. The Address Resolution Protocol (ARP), is used to do this under FDDI or Ethernet. ARP works by broadcasting a packet to all hosts attached to an Ethernet. The packet contains the IP address the sender is interested in communicating with. Most hosts ignore the packet. The target machine, recognizing that the IP address in the packet matches its own, returns an answer.

Reasons For Excessive ARP Broadcasts Requests

[a] Duplicate IP addresses - Make sure IPs are correctly assigned. Use arpping command to detect all duplicate IP address.

[b] Make sure subnet masks are valid for entire network.

[c] Disable IPMI-LAN connection if not used via BIOS or motherboard / server setup utility

[d] Replace NIC as it may be soon going out of service (failing NIC)

I recommend running Ethereal software - a network protocol analyzer for Unix and Windows to troubleshoot problem further.

You should follow me on twitter here or grab rss feed to keep track of new changes.

Featured Articles:

{ 2 comments… read them below or add one }

1 Raph April 11, 2008 at 3:04 pm: Just to tell you that Ethereal got replaced by Wireshark
http://www.wireshark.org/
Reply
2 Jeff May 18, 2013 at 12:28 am: I miss the Ethereal website Tag Line: “Sniffing the glue that holds the internet together”.
Reply

Leave a Comment

Previous Faq: Linux: HowTo Identify Server ECC Memory Modules

Next Faq: Understanding /var/account/pacct OR /var/account/acct – Acct File Format