This is our old Q&A Site. Please post any new questions and answers at

Did a capture today which showed my laptop sending ARP after ARP requests to unknown IP addresses.


182 38.717398 HonHaiPr_7c:4c:f9 Broadcast ARP 42 Who has Tell 24 10.035381 HonHaiPr_7c:4c:f9 Broadcast ARP 42 Who has Tell 28 16.794527 HonHaiPr_7c:4c:f9 Broadcast ARP 42 Who has Tell

alt text

Looking for assistance on how to determine what service or program might be causing this?

asked 21 Jun '17, 16:15

geo3d's gravatar image

accept rate: 0%

edited 24 Jun '17, 06:59

grahamb's gravatar image

grahamb ♦

At first look what IP address does your laptop have. I see unicast packet no.134 sourced from IP Probably this is your address. Whereas ARP requests contain "Tell", it means they're sourced from So it can be someone's else laptop sending these ARPs and you see them just because they are broadcasts.

As for ARPs themselves, this looks like ARP scan. It can be some monitoring software doing discovery. But at first - be sure what PC is the source of it.

permanent link

answered 22 Jun '17, 02:13

Packet_vlad's gravatar image

accept rate: 20%

edited 22 Jun '17, 02:14

PVlad, thanks and yes the ARP requests are coming from my wife's laptop (sorry I wasn't more clear on that). She's been having some bandwidth issues lately so I first changed wifi channels to something with much less traffic then next day did a scan for further troubleshooting. That's when I noticed the numerous ARP scans. Did a lookup on the web and noticed someone else came across same exact issue but no resolution was provided. I'm trying to pinpoint the source program that is sending the ARP requests.

(22 Jun '17, 04:36) geo3d

Look for malware.

permanent link

answered 22 Jun '17, 09:08

Velas's gravatar image

accept rate: 0%

Your answer
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here



Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text]( "title")
  • image?![alt text](/path/img.jpg "title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Question tags:


question asked: 21 Jun '17, 16:15

question was seen: 1,909 times

last updated: 24 Jun '17, 06:59

p​o​w​e​r​e​d by O​S​Q​A