[Okta Webinar] Learn how to a build a cloud-first strategyRegister Now


ARP Broadcast Storm

Posted on 2004-10-28
Medium Priority
Last Modified: 2008-02-01
I just downloaded Ethereal and scaned my network.

There are alot of arp broadcasts from all clients and servers.
Some are by host name, some are IP address's

10.x.x.x broadcast arp who has 10.x.x.x? tell 10.x.x.x

NT4.0 PDC server running Wins, DHCP, DNS
Win2K Member running Exchange5.5
Win2k3 member running SUS
XP Pro Clients

I have 10 3com Switchs SS II 3300
10.x.x.x Spanning-tree - (for-bridges)_00   STP
(this is coming off my core switch only)

I also noticed some dns requests the same way as the arp's

I also noticed IPX RIP Request's
00000000.000048b37e0e  00000000.ffffffffffff  IPX RIP Request

Is all this normal?

Question by:CMILLER
  • 4
  • 2

Author Comment

ID: 12439029
I also noticed IPX RIP Request's
00000000.000048b37e0e  00000000.ffffffffffff  IPX RIP Request

this was my Epson Plotter 000048b37e0e was the mac
LVL 43

Accepted Solution

JFrederick29 earned 2000 total points
ID: 12443135
Yes, ARP and RIP requests are normal on an IP/IPX network.  Everytime a system needs to communicate with another system on the same subnet, it must send an ARP request to discover the target system's MAC address (unless the system has previously communicated with the system, the entry resides in the local systems ARP cache, as long as it hasn't aged out).  ARP is a necessary component for IP communication so as long as the traffic is not excessive, it is normal.

How many systems do you have on the local LAN?  

Author Comment

ID: 12444903
about 75
Visualize your virtual and backup environments

Create well-organized and polished visualizations of your virtual and backup environments when planning VMware vSphere, Microsoft Hyper-V or Veeam deployments. It helps you to gain better visibility and valuable business insights.

LVL 43

Expert Comment

ID: 12445671
You should see a good amount of ARP traffic then, you would know if you had an ARP broadcast storm (hundreds and hundreds of ARPS, constantly).  Like I said, it is normal to see ARP traffic on your network.

Author Comment

ID: 12445692
Do you see anything from this network setup that would make it a more efficient network
( as far as traffic )


Author Comment

ID: 12445712
The plotter had a static IP and Netware IPX enabled

I disabled the Netware

Featured Post

Free Tool: Port Scanner

Check which ports are open to the outside world. Helps make sure that your firewall rules are working as intended.

One of a set of tools we are providing to everyone as a way of saying thank you for being a part of the community.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

A brief overview to explain gateways, default gateways and static routes OR NO - you CANNOT have two default gateways on the same server, PC or other Windows-based network device. In simple terms a gateway is formed when a computer such as a serv…
Have you ever set up your wireless router at home or in the office to find that you little pop-up bubble in the bottom right-hand corner of Windows read "IP Conflict - One of more computers on the network have been assigned the following IP address"…
Michael from AdRem Software explains how to view the most utilized and worst performing nodes in your network, by accessing the Top Charts view in NetCrunch network monitor (https://www.adremsoft.com/). Top Charts is a view in which you can set seve…
Despite its rising prevalence in the business world, "the cloud" is still misunderstood. Some companies still believe common misconceptions about lack of security in cloud solutions and many misuses of cloud storage options still occur every day. …

834 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question