cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
738
Views
0
Helpful
1
Replies

Lots of ARP request

nmandal01
Level 1
Level 1

Hi

Lately internet browsing from my LAN network has become very very slow. So I ran a wireshark to see if there is any problem on my LAN network and realize lot of ARP broadcast is going on . (attach is the screenshot) . with destination and source address as 00:00:00:00 

Something doesn't look right can someone please help me what it could be. and what area should I be looking at?

 

 

1 Reply 1

InayathUlla Sharieff
Cisco Employee
Cisco Employee

Looks like it has to do with gratitious arp

http://wiki.wireshark.org/Gratuitous_ARP

-Does the target MAC address ever matter in requests? I gather Solaris uses ff:ff:ff:ff:ff:ff in its standard ARP requests and most other OSes use 00:00:00:00:00:00 instead. Is the use of the ff:ff:ff:ff:ff:ff MAC in the target address above significant in any way? Obviously having a destination address of ff:ff:ff:ff:ff:ff is critical.yes

RFC 3927, which is based on Gratuitous ARP, specifies 00:00:00:00:00:00 for the target MAC. However many simple TCP/IP stacks have an API which permits the specification of only one MAC value, and when the Ethernet Destination field is set to 'broadcast', the ARP target is also set 'broadcast'. Note: Normal ARP requests have the same value in the ARP Packet Target MAC address as in the Ethernet Destination field.

Review Cisco Networking products for a $25 gift card