Constant ARP requests

[mfisher]

Hi,

I have a cisco 4500 with IOS 11.2. Two out of five ethernet interfaces are putting out constant and sequential ARP requests for every address on their subnet. The other three interfaces don't do this. ANy idea what's going on? Thanks.

[chuck.price]

Have you checked the timing on when they flush their arp cache?

[mfisher]

arp timeout is 4 hours, same as the others.

[tbaranski]

This is commonly the result of hosts on the network being infected with worms which scan the local subnet for other hosts to infect.

[mfisher]

Yes, I have seen that. According to etherpeek, though, these requests are originating at the router interface, not at any host.

[tbaranski]

It could be a remote host (i.e., on another subnet) scanning the subnets in question then. In this case it's the router itself that would ARP for the destination addresses.

[Prashanth Krishnappa]

Apply the access-list to check to see if you are hit by blaster virus

http://www.cisco.com/warp/public/707/cisco-sn-20030814-blaster.shtml