This is our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

I was studying protocol analyzes and noted several arp requests

alt text

Is that supposed to mean a broadcast storm, right? When I check these hosts to see your arp table, it doesn't need to make these requests, because your table already has the information. Why do it happen? How can I verify what software in these host are doing that?

asked 11 Nov '16, 09:07

ThiagoM's gravatar image

ThiagoM
11226
accept rate: 0%


I did not properly count the amount of ARP packets in your picture, but it looks like ~40 in 43 sec. This is not a broadcast storm. With a broadcast storm you would see the same ARP packet about 500-10000 times a second depending on your infrastructure. This is caused by a switching loop.

These are normal ARP packets. Every system on the network will time out ARP entries and will send a new ARP request for a flushed entry when it needs to communicate to that particular host again. This usually happens every couple of minutes till up to 240 minutes (cisco routers).

permanent link

answered 11 Nov '16, 09:35

SYN-bit's gravatar image

SYN-bit ♦♦
17.1k957245
accept rate: 20%

hi, current 75485 arp packets, if I check a 'conversation' I see my mac requesting to gateway (192.168.10.1) 43M | 66.622 packets. kinda scary I've never seen this before

(11 Nov '16, 09:44) ThiagoM

Less than one min, 3 addresses are sending a new ARP requests, and these hosts has something in common, they're running windows

(11 Nov '16, 09:49) ThiagoM

Does your system get ARP responses back? And which OS is it running?

(11 Nov '16, 10:00) SYN-bit ♦♦

what I've just observed running wireshark in one these host is a follow several reply in less than one min: 192.168.10.93 is at xx:xx:xx:xx:xx:xx..

(11 Nov '16, 10:43) ThiagoM

Thank you everybody :-)

(14 Nov '16, 04:34) ThiagoM
showing 5 of 6 show 1 more comments
Your answer
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here

By RSS:

Answers

Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text](http://url.com/ "title")
  • image?![alt text](/path/img.jpg "title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Question tags:

×1,620
×31

question asked: 11 Nov '16, 09:07

question was seen: 6,141 times

last updated: 14 Nov '16, 04:34

p​o​w​e​r​e​d by O​S​Q​A