≡ Menu

What Would Cause a Lot of ARP Broadcasts From One System / Machine

Q. I'm experiencing decreased network performance due to ARP broadcasts coming from one system. What would cause a lot of ARP broadcasts from one server / computer?

A. ARP convers a 32 bit IP address into a 48-bit Ethernet address. The Address Resolution Protocol (ARP), is used to do this under FDDI or Ethernet. ARP works by broadcasting a packet to all hosts attached to an Ethernet. The packet contains the IP address the sender is interested in communicating with. Most hosts ignore the packet. The target machine, recognizing that the IP address in the packet matches its own, returns an answer.

Reasons For Excessive ARP Broadcasts Requests

[a] Duplicate IP addresses - Make sure IPs are correctly assigned. Use arpping command to detect all duplicate IP address.

[b] Make sure subnet masks are valid for entire network.

[c] Disable IPMI-LAN connection if not used via BIOS or motherboard / server setup utility

[d] Replace NIC as it may be soon going out of service (failing NIC)

I recommend running Ethereal software - a network protocol analyzer for Unix and Windows to troubleshoot problem further.

Tweet itFacebook itGoogle+ itPDF itFound an error/typo on this page?

{ 2 comments… add one }

  • Raph April 11, 2008, 3:04 pm

    Just to tell you that Ethereal got replaced by Wireshark


  • Jeff May 18, 2013, 12:28 am

    I miss the Ethereal website Tag Line: “Sniffing the glue that holds the internet together”.

Leave a Comment