This is our old Q&A Site. Please post any new questions and answers at

I'm kind of new to the world of monitoring network activity and I'm seeing something in my logs that concerns me a little.

One computer, and only one, seems to be sending ARP requests to every single possible IP address ("Who has, Who has etc.).

No other machine on this network is doing this. As I cannot fathom any legitimate reason any machine ought to be pinging every possible address, I'm thinking this machine probably has a virus looking to do mischief.


asked 22 Jan '12, 16:13

Riversiderepeat's gravatar image

accept rate: 0%

If you see ARP packets for a full network range you might have some sort of ping sweep in your network, where a system tries to find out which other IPs are there. There are some legitimate reasons for it, for example if it comes from a network monitoring system. You'll have to identify the source of the ARP requests - you should see a "tell 192.168..." somewhere, which is always the same in Ping Sweeps, and that is the system scanning.

If the source is a system that should NOT do anything like this you might have a problem. Next step is to identify what software is running that may cause this, and evaluate if it really a case of mischief.

permanent link

answered 22 Jan '12, 17:43

Jasper's gravatar image

Jasper ♦♦
accept rate: 18%

There are some home routers that do this. I have a Netopia router that does an ARP scan of the entire subnet every five minutes. There is no way to turn it off or change the interval, so it's expected behavior in my network.

permanent link

answered 23 Jan '12, 00:09

Jim%20Aragon's gravatar image

Jim Aragon
accept rate: 24%

Your answer
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here



Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text]( "title")
  • image?![alt text](/path/img.jpg "title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Question tags:


question asked: 22 Jan '12, 16:13

question was seen: 9,700 times

last updated: 23 Jan '12, 00:09

p​o​w​e​r​e​d by O​S​Q​A