This is a static archive of our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

Extra ARP Responses

0

Looking at a capture in which I see the following sequence repeated throughout: 1. an ARP request goes out 2. an ARP response comes back in.
3. The requestor then sends the packet it wanted to go to that destination, e.g., a UDP packet, so I can tell that it saw the ARP response.
4. Then, it appears that the responder sends back the same ARP response (exact duplicate) several more times, ranging from 6 to 15 times, all in a short time window.

This appears to be happening for all devices on the network, regardless of type or manufacture. So I don't suspect a device stack problem, but a network issue. Could this be some network switch behavior?

We are having some communication reliability issues with our equipment on this network and wonder if this points to a core issue with the network devices.

asked 06 Apr '16, 13:15

kentench's gravatar image

kentench
6112
accept rate: 0%

could you provide us a trace with the ARP packets at public accessible place, like google or clouds

(06 Apr '16, 13:46) Christian_R
(06 Apr '16, 13:52) kentench

Where did you take the trace? ( Span port/ vm,....)

(07 Apr '16, 06:29) Christian_R

It was captured on a Windows NIC for the device with MAC MitacInt_ac:af:0e, IP:10.71.67.21, which is our controller that is talking to various devices in the system. It was easier to see all the ARP traffic after I applied the View Filter !tcp which eliminated all the VNC and RFB remote access traffic. This capture was taken by remoting into this operational system and performing the capture on the controller box. So, this is the traffic seen at the controller NIC minus some network audio traffic which was filtered out of the capture.

(07 Apr '16, 07:54) kentench

First of all: The easiest way to filter for arp is: arp

Can trace outside the system. Perhaps it is just a capturing problem, also you can check if you use the newest network drivers.

(07 Apr '16, 09:38) Christian_R