too many arp_rarp ? why is this

[DJ]

ARP is a good thing.
No need to worry bout it. Here how it functions :
PC A needs to send a packet to PC B :
1. PC A looks in its ARP cache to see if it has the
MAC of (PC B) or (Default Gateway of PC A).
2. PC A checks whether PC B IP's address is in the same
subnet.
3a. If its in the same subnet it send a frame with MAC
address FFFFFFFFFFFF (broadcast) so every PC in the local
subnet can read this frame. The frame inside has the
target IP address of PC B. So when PC B reads this ARP
request it will reply to PC A and PC A will be able to
send future packets to PC B with its actuall MAC address.
MAC IP content
FFFFFFFFFFFF | PC B IP | WHAT IS YOUR MAC |

3b. If its on different subnet, then PC A will try to get
the MAC of its DEFAULT GATEWAY the same way as in 3a.

MAC IP content
FFFFFFFFFFFF | DEF GATEWAY IP | WHAT IS YOUR MAC |

then it will send the packet to PC B in this format :

MAC IP content
DEF GATEWAY MAC | PC B IP | WHATSUP |

Hope you got it

 

[aaaa]

When I do network monitor test to my station, I see many, many, many
broadcast coming from one particular windows 2000 machine....
I find out that by checking ARP check in that anylysis. And I see lot of
inbound/outbound request is going from that particular machine...
what can be the reason..... ? Too many broadcast is not good at all.........

ARP is a good thing.
No need to worry bout it. Here how it functions :
PC A needs to send a packet to PC B :
1. PC A looks in its ARP cache to see if it has the
MAC of (PC B) or (Default Gateway of PC A).
2. PC A checks whether PC B IP's address is in the same
subnet.
3a. If its in the same subnet it send a frame with MAC
address FFFFFFFFFFFF (broadcast) so every PC in the local
subnet can read this frame. The frame inside has the
target IP address of PC B. So when PC B reads this ARP
request it will reply to PC A and PC A will be able to
send future packets to PC B with its actuall MAC address.
MAC IP content
FFFFFFFFFFFF | PC B IP | WHAT IS YOUR MAC |

3b. If its on different subnet, then PC A will try to get
the MAC of its DEFAULT GATEWAY the same way as in 3a.

MAC IP content
FFFFFFFFFFFF | DEF GATEWAY IP | WHAT IS YOUR MAC |

then it will send the packet to PC B in this format :

MAC IP content
DEF GATEWAY MAC | PC B IP | WHATSUP |

Hope you got it

 

[dj]

Are they for different IPs? If so - it tries to
communicate with the other machines on yuor local subnet.
so the reason for ARP is beacuse the machine needs to
communicate with the others. What type of machine is it?
Check for viruses. check for running software. Try to find
the reason WHY it wants to establish remote connection.