Large number of ARP request on network?

[Tim A. Fleming]

Hello,

I have downloaded Etherreal and have noticed a large number of Address
Resolution Protocol requests on our network. Systems are asking
(particularly the server) who has address 192.168.?.?.

We are running DNS and DHCP which when we enter IPCONFIG on a desktop
everything reports back correctly. All desktops are running Win2K
professional and the server is running Win2k Server.

Everything seems to be working but the number of ARP request concern me.
Should I be concerned?

I always thought that using DHCP and DNS would reduce or eliminate ARP
broadcasts. I know the client will initiate a Dhcpdiscover packet upon
initial bootup. That systems a client talks to will be added to the ARP
cach. But broadcasts should be reduced or eliminated if you have setup DHCP
and DNS correctly.

Thank You.

 

[Dave]

that can be a symptom of blaster, welchia or nachi worm infestations. check
all machines for those and any other virus/worm while you are at it. part
of the question is, how large is large? i have seen one machine on a
100mbit ethernet virtually saturate the t1 feeding our office with that
stuff... or is it an arp a minute or something like that??

 

[Rob Elder, MVP-Networking]

DHCP and DNS have nothing to do with ARP. Bottom line is all network
communications are made between MAC addresses. Arp cache is dynamic.
Unless contact between PCs is maintained, entries are dropped.

 

[Dusko Savatovic]

AFAIK, you should not be worried about ARP packets. I'm not aware of any
exploits that take advantage of ARP.

Dusko Savatovic