[OT] ARP Flooding

["Julian Stuhler" <julian.stuhler@xxxxxxx>]

Apologies for the OT post - I'm hoping one of the resident networking
gurus can answer a question that's really bugging me.

Every now and again, performance on my home network drops off
noticeably. Looking at the LAN activity lights for any of the connected
devices shows frantic activity, even when nothing is actually being
transmitted as far as any of the clients are concerned.

To try and figure out what was going on, I downloaded a trial version of
Aligent Advisor LAN so that I could see what all the mysterious activity
was for. It turns out that my Win2K server is issuing thousands and
thousands of ARP requests, starting at a value (e.g. 192.170.193.0) and
incrementing the target address by 1 each time. Usually, the target
addresses are outside of my local subnet (192.168).

Sure enough, when I take a look at the ARP entries on the Win2K box, it
shows a whole load of invalid entries for the addresses its being trying
most recently:

C:\Documents and Settings\Administrator>arp -a

Interface: 192.168.1.1 on Interface 0x1000003
Internet Address      Physical Address      Type
192.168.1.11          00-20-e0-66-4b-aa     dynamic
192.170.200.135       00-00-00-00-00-00     invalid
192.170.200.136       00-00-00-00-00-00     invalid
192.170.200.137       00-00-00-00-00-00     invalid
192.170.200.138       00-00-00-00-00-00     invalid
192.170.200.139       00-00-00-00-00-00     invalid
.and so on

The ARP activity will go on for 5-10 minutes, stop for a while and then
start again (often with a different set of target IP addresses) for no
apparent reason. This is driving me nuts!

Does anybody know what is responsible for issuing these ARP requests,
and how I can stop it? Could this be the cause of the performance
problems I'm seeing?

Many thanks, as always,

Julian




[Non-text portions of this message have been removed]