What Would Cause a Lot of ARP Broadcasts From One System / Machine

by on March 27, 2008 · 2 comments· LAST UPDATED March 27, 2008

in , ,

Q. I'm experiencing decreased network performance due to ARP broadcasts coming from one system. What would cause a lot of ARP broadcasts from one server / computer?

A. ARP convers a 32 bit IP address into a 48-bit Ethernet address. The Address Resolution Protocol (ARP), is used to do this under FDDI or Ethernet. ARP works by broadcasting a packet to all hosts attached to an Ethernet. The packet contains the IP address the sender is interested in communicating with. Most hosts ignore the packet. The target machine, recognizing that the IP address in the packet matches its own, returns an answer.

Reasons For Excessive ARP Broadcasts Requests

[a] Duplicate IP addresses - Make sure IPs are correctly assigned. Use arpping command to detect all duplicate IP address.

[b] Make sure subnet masks are valid for entire network.

[c] Disable IPMI-LAN connection if not used via BIOS or motherboard / server setup utility

[d] Replace NIC as it may be soon going out of service (failing NIC)

I recommend running Ethereal software - a network protocol analyzer for Unix and Windows to troubleshoot problem further.

TwitterFacebookGoogle+PDF versionFound an error/typo on this page? Help us!

{ 2 comments… read them below or add one }

1 Raph April 11, 2008 at 3:04 pm

Just to tell you that Ethereal got replaced by Wireshark

http://www.wireshark.org/

Reply

2 Jeff May 18, 2013 at 12:28 am

I miss the Ethereal website Tag Line: “Sniffing the glue that holds the internet together”.

Reply

Leave a Comment

Tagged as: , , , , , , , , , , , , , , , , , ,

Previous Faq:

Next Faq: