ARP Broadcast Storm

Posted on 2004-10-28
Last Modified: 2008-02-01
I just downloaded Ethereal and scaned my network.

There are alot of arp broadcasts from all clients and servers.
Some are by host name, some are IP address's

10.x.x.x broadcast arp who has 10.x.x.x? tell 10.x.x.x

NT4.0 PDC server running Wins, DHCP, DNS
Win2K Member running Exchange5.5
Win2k3 member running SUS
XP Pro Clients

I have 10 3com Switchs SS II 3300
10.x.x.x Spanning-tree - (for-bridges)_00   STP
(this is coming off my core switch only)

I also noticed some dns requests the same way as the arp's

I also noticed IPX RIP Request's
00000000.000048b37e0e  00000000.ffffffffffff  IPX RIP Request

Is all this normal?

Question by:CMILLER

    Author Comment

    I also noticed IPX RIP Request's
    00000000.000048b37e0e  00000000.ffffffffffff  IPX RIP Request

    this was my Epson Plotter 000048b37e0e was the mac
    LVL 43

    Accepted Solution

    Yes, ARP and RIP requests are normal on an IP/IPX network.  Everytime a system needs to communicate with another system on the same subnet, it must send an ARP request to discover the target system's MAC address (unless the system has previously communicated with the system, the entry resides in the local systems ARP cache, as long as it hasn't aged out).  ARP is a necessary component for IP communication so as long as the traffic is not excessive, it is normal.

    How many systems do you have on the local LAN?  

    Author Comment

    about 75
    LVL 43

    Expert Comment

    You should see a good amount of ARP traffic then, you would know if you had an ARP broadcast storm (hundreds and hundreds of ARPS, constantly).  Like I said, it is normal to see ARP traffic on your network.

    Author Comment

    Do you see anything from this network setup that would make it a more efficient network
    ( as far as traffic )


    Author Comment

    The plotter had a static IP and Netware IPX enabled

    I disabled the Netware

    Write Comment

    Please enter a first name

    Please enter a last name

    We will never share this with anyone.

    Featured Post

    What Security Threats Are You Missing?

    Enhance your security with threat intelligence from the web. Get trending threat insights on hackers, exploits, and suspicious IP addresses delivered to your inbox with our free Cyber Daily.

    A brief overview to explain gateways, default gateways and static routes OR NO - you CANNOT have two default gateways on the same server, PC or other Windows-based network device. In simple terms a gateway is formed when a computer such as a serv…
    This article is in response to a question ( here at Experts Exchange. The Original Poster (OP) requires a utility that will accept a list of IP addresses …
    Hi everyone! This is Experts Exchange customer support.  This quick video will show you how to change your primary email address.  If you have any questions, then please Write a Comment below!
    This video discusses moving either the default database or any database to a new volume.

    759 members asked questions and received personalized solutions in the past 7 days.

    Join the community of 500,000 technology professionals and ask your questions.

    Join & Ask a Question

    Need Help in Real-Time?

    Connect with top rated Experts

    11 Experts available now in Live!

    Get 1:1 Help Now