Looking at a capture in which I see the following sequence repeated throughout: 1. an ARP request goes out 2. an ARP response comes back in. This appears to be happening for all devices on the network, regardless of type or manufacture. So I don't suspect a device stack problem, but a network issue. Could this be some network switch behavior? We are having some communication reliability issues with our equipment on this network and wonder if this points to a core issue with the network devices. asked 06 Apr '16, 13:15  kentench |
This is a static archive of our old Q&A Site.
Please post any new questions and answers at ask.wireshark.org.
could you provide us a trace with the ARP packets at public accessible place, like google or clouds
Here it is (Dropbox): https://www.dropbox.com/s/1ufdnycwqoqh9de/cap4-6-16nocobra.pcapng?dl=0
Where did you take the trace? ( Span port/ vm,....)
It was captured on a Windows NIC for the device with MAC MitacInt_ac:af:0e, IP:10.71.67.21, which is our controller that is talking to various devices in the system. It was easier to see all the ARP traffic after I applied the View Filter !tcp which eliminated all the VNC and RFB remote access traffic. This capture was taken by remoting into this operational system and performing the capture on the controller box. So, this is the traffic seen at the controller NIC minus some network audio traffic which was filtered out of the capture.
First of all: The easiest way to filter for arp is: arp
Can trace outside the system. Perhaps it is just a capturing problem, also you can check if you use the newest network drivers.