W2k LAN ARP Storm.

[Thomas Curcio]

We have a W2k LAN here (a few W2k3 servers as well), and
we're having some serious issues with ARP traffic, there
seems to be a storm and I can not seem to pin point the
offending system or systems that are causing this problem.

There is traffic all over the LAN between servers,
workstation, and printers.

Has anyone else had this problem? If so, does anyone
have a solution? I've searched the news groups, and have
noticed that a few others are having similar issues, but
not like what I'm seeing. I've also searched the KB, and
found an article that talks about this type of problem,
but that didn't help me either.

It seems that I don't have the registry key for this fix
KB Q219374, should I add the key and then apply the fix?

Anyone with a suggestion or idea on how I can resolve
this problem, feel free to post a reply or send email to
me at..

(e-mail address removed)

Thanks..

Tom

 

[Alan Wood [MSFT]]

Hi Tom,
Have you taken a network trace and determined what device is making the
ARP requests?

The article you mentioned enables and disabled Gratuitous ARP's and these
are good thing!
Meaning there may be special circumstances were you would need\want to
disable this feature but in general this is good and ONLY happens when a
system is rebooted or in W2K and above, the network adapter is disable and
enabled.

1. How have you determined the problem is ARP STORMS?
2. Network traces? If yes can you see on MAC that is constently making
the reqeust?
3. If not ,what type of switches are you using, this could be bad config on
a switch. Is Proxy ARP enabled?

This is a tough one without more data but in all honesty, if you are truly
having ARP Broadcast storms I would start with Switch config.

Thank you,

Alan Wood[MSFT]

This posting is provided "AS IS" with no warranties, and confers no rights.

 

[Thomas Curcio]

Alan,

Thank you for your response. We are using Ethereal to
sniff out the LAN, as well as Solar Winds software. It
looks as if all the ARP traffic is localized to our LAN.

When using the Ethereal sniffer, we see ALL workstations,
and printers sending ARP traffic across the LAN, there
doesn't seem to be any one specific offending machine.
We are looking at the switches, and have been keeping
tabs on those. We've adjusted a few settings on the
switches and that has helped, but not cured the problem.

We're running HP ProCurve switches, HP & DELL servers,
Win2k, and W2k3 server OS, and W2k and XP Pro WKST.

The ARP traffic was about 50 to 80%, now down to about
20 - 25%. I'd like to know what the average ARP
percentage should be on a Windows LAN, so far I've heard
between 2 and 5% at the max, but I'm not so sure.

We'll continue to check the switches and see what we can
find. Your input is appreciated, thank you for the
direction.

Tom.