Cisco Support Community
Community Member

Lots of ARP request


Lately internet browsing from my LAN network has become very very slow. So I ran a wireshark to see if there is any problem on my LAN network and realize lot of ARP broadcast is going on . (attach is the screenshot) . with destination and source address as 00:00:00:00 

Something doesn't look right can someone please help me what it could be. and what area should I be looking at?



Everyone's tags (1)
Cisco Employee

Looks like it has to do with

Looks like it has to do with gratitious arp

-Does the target MAC address ever matter in requests? I gather Solaris uses ff:ff:ff:ff:ff:ff in its standard ARP requests and most other OSes use 00:00:00:00:00:00 instead. Is the use of the ff:ff:ff:ff:ff:ff MAC in the target address above significant in any way? Obviously having a destination address of ff:ff:ff:ff:ff:ff is critical.yes

RFC 3927, which is based on Gratuitous ARP, specifies 00:00:00:00:00:00 for the target MAC. However many simple TCP/IP stacks have an API which permits the specification of only one MAC value, and when the Ethernet Destination field is set to 'broadcast', the ARP target is also set 'broadcast'. Note: Normal ARP requests have the same value in the ARP Packet Target MAC address as in the Ethernet Destination field.

CreatePlease to create content