Flooded by ARP packets

pymehta · 04-15-2005, 06:32 AM

System monitor shows upto 50% network activity on 100 Mbps connection. Ethereal shows that 80 - 90% packates are ARP packets and 10% UPD, even when there is no network connection on my standalone machine on lan (Not using NIS, NFS or other network services). What could be reason for this?

fr_laz · 04-15-2005, 06:52 AM

Hi,

If you have several switches ou hubs, then you may experience looping issues : if spanning tree isn't enabled or is misconfigured and if you've some loops in your LAN, then arp broadcast are for ever forwarded from a switch to another, and another till saturation of bandwidth.

pymehta · 04-15-2005, 07:11 AM

I do not have complete topology of our campus lan available, but is it possible to make sure existance of loops using some network tools? All I know is our network switch is connected to fibre optic backend of the campus. However, I have not encountered this problem using machines on other subnets of campus network.

scowles · 04-15-2005, 07:25 AM

In addition to what fr_laz posted - if the arps are from the same source and arp'ing for IP addresses in sequence i.e.

who has 10.1.1.1, tell 10.2.3.4
who has 10.1.1.2, tell 10.2.3.4
who has 10.1.1.3, tell 10.2.3.4
etc...

Then there is a good chance you have a virus infected computer on your subnet looking to infect other computers.

pymehta · 04-15-2005, 07:46 AM

Yes, most of the packets are such. I also thought of virus but source and destination packets are not from same machines. As source and destination both are varying, I ruled out that possibility, However, it might be a smart virus or a group of infected machines. Other thing is that all discovery requests are not for valid IP, It appears like random probing. The problem is our subnet is very large (Thousands of machines) divided in sub-sub-nets of hundreds of machines.

Thanks anyway for suggestions.