BROWSER Host Announcement machine, workstation, server

This is normal operation.  Windows (actually NETBIOS devices) will broadcast to let the world know that it exists.  I forget the exact timeing, but Windows will broadcast when it startup, then 30 seconds later and then in increases the time between broadcasts until it works it way up to  once every 12 minutes.

Why is this causing you a problem?  Unless you have a fairly large flat IP subnet, this should cause very little traffic on your LAN.

the problem is I do have a large flat network. i'm working on segmenting it. if i disable netbios over tcp/ip those announcement should stop right?

Yes the annoucments will stop.  However so will your ability to do file sharing and just about anything else that Windows does over the LAN.

How large and how flat? For this to be a problem I would assume that you would need to have thousands of PC's.  We have hundreds (500-600) and the broadcasts are a small percentage of our traffic.  ARP's make up more the of the traffic than NETBIOS broad casts.

i don't need to do any  file sharing between workstations. all shares are on the servers and i'm not going to disable netbios for them. my network is about 300-350 macs &PCs.
i see a lot of arp-ing between workstations and they should need to know of eachother.  

doing a capture with ethereal i see the arps are 58% of the traffic. is this normal? could it be anything wrong with the arp chache on machines? virus? i'm going crazy here.

I think you are in over your head.  NETBIOS is the protocol used to allow file sharing, on  both sides.  That is a desktop uses NETBIOS to map a drive to a server and to read and write file from/to the server.

It like having a telephone.  You need one if you are going make calls or receive calls.  Just because you are not going to make a call does not mean that you do not need a phone.

Be careful of how you look at things.  ARP's accounting for 58% of all packets, yes that is nomal.  However ARP's accounting for 58% of all traffic, which normally means byte count,  is abnormal.

Hosts cache ARP's for a very short time period.  I not sure what the default is on Windows, but I have seen any where from as low as 30 seconds to as high as 5 minutes.  You can set it on some devices, but 30 seconds to 5 minutes are the "normal" defaults.   So if host does not "talk" to another computer for the cache time, the ARP entry is purged from the cache and the next time it needs to talk to it, it must issue the ARP again.