Home > Ask the Networking Experts > Questions & Answers > What is the best way to determine the cause of an ARP saturated network?
Ask The Networking Expert: Questions & Answers
EMAIL THIS

What is the best way to determine the cause of an ARP saturated network?

Retired expert - Loki Jorgenson, Ph. D. EXPERT RESPONSE FROM: Retired expert - Loki Jorgenson, Ph. D.

Pose a Question
Other Networking Categories
Meet all Networking Experts
Become an Expert for this site


Digg This!    StumbleUpon Toolbar StumbleUpon    Bookmark with Delicious Del.icio.us   


>
QUESTION POSED ON: 20 February 2004
What is the best way to determine the cause of an ARP saturated network?

Using my Fluke network monitor I will notice that ARP is running anywhere from 50% to 75%. While IP is around 30% to 50%. I can't seem to find any rime or reason for this high ARP traffic. It comes and goes at random lasting anywhere from two minutes to hours.

We are currently a single NT4 domain with about 500 nodes running a mixed NT4 workstation & Windows 2000 Pro on a switched network, with both Netbeui and IP protocols active. We are also a part of Trust in an Active Directory.


>
EXPERT RESPONSE
I am not familiar with this phenomenon. It sounds unusual and it would need additional investigation. Here's what I would suggest as working hypotheses in order of priority:
  1. You have a worm of some sort that is using the ARP mechanisms to propagate. Variants of Code Red cause ARP flooding.

  2. Somehow your hosts are not properly caching ARP data and constantly expiring it, possibly generating per-packet requests. I can't see how but it may be some consequence of an overly secure Trust configuration on Active Directory.

I would also sniff the packets to determine if a few hosts are responsible or all of them.


Digg This!    StumbleUpon Toolbar StumbleUpon    Bookmark with Delicious Del.icio.us   


RELATED CONTENT
Network Monitoring
Measure wireless network performance using testing tool iPerf
Why wireless network cards show activity when no one uses the computer
WildPackets' packet analysis tool helps newspaper fix network problems
Networking data visualization not just for pointy-headed bosses
What network security threat does a QM FSM error pose in IPsec VPNs?
Juniper updates Network and Security Manager to manage full portfolio
Network management software vendors readying IPv6
DNS management becoming critical to businesses but poorly understood
SolarWinds adds enterprise scalability to its network monitoring tool
Network forensics appliance gets storage boost and 10 GbE support
Network Monitoring Research

RELATED GLOSSARY TERMS
Terms from Whatis.com − the technology online dictionary
10-high-day busy period  (SearchNetworking.com)
ACK  (SearchNetworking.com)
baseboard management controller  (SearchNetworking.com)
call failure rate  (SearchNetworking.com)
jam  (SearchNetworking.com)
Jini  (SearchNetworking.com)
maximum segment size  (SearchNetworking.com)
maximum transmission unit  (SearchNetworking.com)
netstat  (SearchNetworking.com)
network tracking tool  (SearchNetworking.com)

RELATED RESOURCES
2020software.com, trial software downloads for accounting software, ERP software, CRM software and business software systems
Search Bitpipe.com for the latest white papers and business webcasts
Whatis.com, the online computer dictionary



Search and Browse the Expert Answer Center
Search and browse more than 25,000 question and answer pairs from more than 250 TechTarget industry experts.
Browse our Expert Advice



Expert networking advice and tips for IT professionals
HomeNewsTopicsITKnowledge ExchangeTipsAsk the ExpertsMultimediaWhite PapersNetworking Product Trials
About Us  |  Contact Us  |  For Advertisers  |  For Business Partners  |  Site Index  |  RSS
SEARCH 
TechTarget provides enterprise IT professionals with the information they need to perform their jobs - from developing strategy, to making cost-effective IT purchase decisions and managing their organizations' IT projects - with its network of technology-specific Web sites, events and magazines.

TechTarget Corporate Web Site  |  Media Kits  |  Reprints  |  Site Map




All Rights Reserved, Copyright 2000 - 2008, TechTarget | Read our Privacy Policy
  TechTarget - The IT Media ROI Experts