massive ARP traffic problem

[John Lutz]

I am having a problem with massive amounts of ARP traffic
coming from windows machines on our network. I work at a
University and when the students moved into the dorms for
the fall semester our network slowed to a crawl. When I put
a sniffer on the net I found that 95%+ of the traffic was
ARP. Does anyone have any idea how to deal with this problem,
what is causing it, or how to eliminate it?

Thanks
John Lutz
University of New Mexico

 

[John Lutz]

Marc, supposedly these machines have all been patched and
cleaned, some to the point of reformatting and reinstalling
the OS's. Could these becoming from WINS or netbios?

Thanks
John Lutz

 

[Doug Sherman [MVP]]

I agree with Marc - arp flooding is a characteristic of nimbda and blaster
worms on internal networks. Double check for arp traffic seeking
consecutive IP addresses. See:

http://securityresponse.symantec.com/avcenter/venc/data/detecting.traffic.due.to.rpc.worms.html

Doug Sherman
MCSE Win2k/NT4.0, MCSA, MCP+I, MVP