Gratuitous ARP on non-existent IP

[Guest]

I have 2 Windows XP machines that are sening out gratuitous ARP packets for
addresses that don't exist on our LAN. These machines have IP addresses of
192.168.6.40 and 192.168.6.41 but they keep sending gratuitous ARP requests
every 2 seconds for the IP 192.168.30.32.

Does anyone have any idea why these machines would do this?

 

[Ron Lowe]

I have 2 Windows XP machines that are sening out gratuitous ARP packets for
addresses that don't exist on our LAN. These machines have IP addresses of
192.168.6.40 and 192.168.6.41 but they keep sending gratuitous ARP
requests
every 2 seconds for the IP 192.168.30.32.

Does anyone have any idea why these machines would do this?

Common causes are:
Old DNS / WINS servers or gateways listed in TCP/IP properties;
( fix - delete the entries. )
Old TCP/IP printer ports which are no longer in use.
( fix - un-install any old printers using these ports, and delete the
ports. )

Here's a possible way to investigate further:
Download and install the free version of ZoneAlarm or some other host-based
firewall which provides outbound filtering.
This will let you know when a program is attempting an outbound connection.
Use this to determine what program is doing this as a first step.

Another oddity caught my eye...

What's the subnet mask in use on the machines?
For an IP address of 192.168.6.40, I'd expect it to be 255.255.255.0

Which raises the first question:
If it wants to contact 192.168.30.x, why is it ARPing it on the local
subnet?

If the subnet mask is wider, say 255.255.0.0, then 192.168.30.32 is on the
local subnet, and ARP is OK.

 

[Guest]

Common causes are:
Old DNS / WINS servers or gateways listed in TCP/IP properties;
( fix - delete the entries. )
Old TCP/IP printer ports which are no longer in use.
( fix - un-install any old printers using these ports, and delete the
ports. )

Couldn't find anything suspicious.

Here's a possible way to investigate further:
Download and install the free version of ZoneAlarm or some other host-based
firewall which provides outbound filtering.
This will let you know when a program is attempting an outbound connection.
Use this to determine what program is doing this as a first step.

It only stops when I shut off the entire connection with Zone Alarm - so it
must be the OS itself, not a seperate app we have running.

Another oddity caught my eye...

What's the subnet mask in use on the machines?
For an IP address of 192.168.6.40, I'd expect it to be 255.255.255.0

Subnet mask is 255.255.255.0