What Would Cause a Lot of ARP Broadcasts From One System / Machine

Q. I’m experiencing decreased network performance due to ARP broadcasts coming from one system. What would cause a lot of ARP broadcasts from one server / computer?

A. ARP convers a 32 bit IP address into a 48-bit Ethernet address. The Address Resolution Protocol (ARP), is used to do this under FDDI or Ethernet. ARP works by broadcasting a packet to all hosts attached to an Ethernet. The packet contains the IP address the sender is interested in communicating with. Most hosts ignore the packet. The target machine, recognizing that the IP address in the packet matches its own, returns an answer.

Advertisement

Reasons For Excessive ARP Broadcasts Requests

[a] Duplicate IP addresses – Make sure IPs are correctly assigned. Use arpping command to detect all duplicate IP address.

[b] Make sure subnet masks are valid for entire network.

Disable IPMI-LAN connection if not used via BIOS or motherboard / server setup utility

[d] Replace NIC as it may be soon going out of service (failing NIC)

I recommend running Ethereal software – a network protocol analyzer for Unix and Windows to troubleshoot problem further.

🥺 Was this helpful? Please add a comment to show your appreciation or feedback.

nixCrat Tux Pixel Penguin
Hi! 🤠
I'm Vivek Gite, and I write about Linux, macOS, Unix, IT, programming, infosec, and open source. Subscribe to my RSS feed or email newsletter for updates.

2 comments… add one
  • Raph Apr 11, 2008 @ 15:04

    Just to tell you that Ethereal got replaced by Wireshark

    http://www.wireshark.org/

  • Jeff May 18, 2013 @ 0:28

    I miss the Ethereal website Tag Line: “Sniffing the glue that holds the internet together”.

Leave a Reply

Your email address will not be published. Required fields are marked *

Use HTML <pre>...</pre> for code samples. Your comment will appear only after approval by the site admin.