+ Post New Thread
Results 1 to 11 of 11
Wireless Networks Thread, High ARP traffic? in Technical; Hello, I'm hoping that someone here will be able to answer a question about ARP traffic. I have been using ...
  1. #1
    drewp's Avatar
    Join Date
    Sep 2007
    Posts
    98
    Thank Post
    38
    Thanked 4 Times in 3 Posts
    Rep Power
    15

    High ARP traffic?

    Hello, I'm hoping that someone here will be able to answer a question about ARP traffic.

    I have been using Wireshark to try and diagnose a slow network and, I seem to have lots of ARP traffic. It's about 40-45% no matter how long the capture runs for -smallest capture is 5 minutes longest is 2 hours.

    Should I be seeing this amount of ARP traffic on a network? I have about 250 computers 8 Servers. I have a gigabit switch as a backbone which links up to other 100mbit switches. I have a vanilla Windows 2003 domain with DNS and WINS configured and XP SP2 clients.

    Thanks in advance!

  2. #2

    Geoff's Avatar
    Join Date
    Jun 2005
    Location
    Fylde, Lancs, UK.
    Posts
    11,850
    Thank Post
    110
    Thanked 598 Times in 514 Posts
    Blog Entries
    1
    Rep Power
    227
    No you should not. There are several reasons for high arp traffic:

    1) A badly configured load balancer
    2) A network loop
    3) Faulty switch/network card/wiring.

  3. #3

    Join Date
    Jun 2007
    Location
    Rochdale
    Posts
    239
    Thank Post
    28
    Thanked 35 Times in 30 Posts
    Rep Power
    21
    How much is a lot?
    is it a hundred or so packets per minute, which probably isnt excessive for a network your size, or several thousand per minute which is excessive.

    We noticed this on our network, where over 60% of traffic was ARP but this turned out to be purely because there was so little other broadcast traffic.

  4. #4

    localzuk's Avatar
    Join Date
    Dec 2006
    Location
    Minehead
    Posts
    18,517
    Thank Post
    526
    Thanked 2,641 Times in 2,045 Posts
    Blog Entries
    24
    Rep Power
    923
    Our network has 200 machines on it and prior to VLANing it the ARP traffic was about 5% maximum...

  5. #5
    drewp's Avatar
    Join Date
    Sep 2007
    Posts
    98
    Thank Post
    38
    Thanked 4 Times in 3 Posts
    Rep Power
    15
    Thanks for the replies so far! A bit new to packet sniffing, so going to have a few gaps in my knowledge...

    Just done a 1 minute capture - 179 packets

    89 ARP packets - 49% (84 of them are broadcasted)
    61 Intel ANS probe packets - 34%
    29 Internet Protocol - 16%

    The ARP packets are all from Server IP addresses for Client IP Addresses, so i guess this could be normal

  6. #6

    Geoff's Avatar
    Join Date
    Jun 2005
    Location
    Fylde, Lancs, UK.
    Posts
    11,850
    Thank Post
    110
    Thanked 598 Times in 514 Posts
    Blog Entries
    1
    Rep Power
    227
    That doesn't seem unreasonable. If you're still bothered about it, consider using one or more VLANs to segment your network.

  7. #7

    localzuk's Avatar
    Join Date
    Dec 2006
    Location
    Minehead
    Posts
    18,517
    Thank Post
    526
    Thanked 2,641 Times in 2,045 Posts
    Blog Entries
    24
    Rep Power
    923
    179 packets isn't that bad over a minute.

  8. #8
    drewp's Avatar
    Join Date
    Sep 2007
    Posts
    98
    Thank Post
    38
    Thanked 4 Times in 3 Posts
    Rep Power
    15
    Thanks for your help on this, I was wondering if that could be slowing the network down.

    I don't know that much about VLAN's so will have to do a bit of reading about them. As I understand it at the moment VLAN's will only allow data to pass between the ports configured in the VLAN and not other ports on the Switch. So a really silly question is how would a node in a VLAN communicate to something outside of its VLAN?

  9. #9

    localzuk's Avatar
    Join Date
    Dec 2006
    Location
    Minehead
    Posts
    18,517
    Thank Post
    526
    Thanked 2,641 Times in 2,045 Posts
    Blog Entries
    24
    Rep Power
    923
    Quote Originally Posted by drewp View Post
    Thanks for your help on this, I was wondering if that could be slowing the network down.

    I don't know that much about VLAN's so will have to do a bit of reading about them. As I understand it at the moment VLAN's will only allow data to pass between the ports configured in the VLAN and not other ports on the Switch. So a really silly question is how would a node in a VLAN communicate to something outside of its VLAN?
    You would need a router to route traffic between the VLANs. I have an HP 5406zl intelligent switch which does the job.

  10. #10

    Join Date
    Jan 2008
    Posts
    2
    Thank Post
    0
    Thanked 0 Times in 0 Posts
    Rep Power
    0
    One reason may be that you are sniffing a switch and that you are not really seeing all the traffic. Make sure you mirror the backbone to your port to see as much of the data as possible. Otherwise you will have lower traffic flow and all the broadcast traffic will seem high.

    I sometimes take a look at broadcast traffic without a mirrored port and it is always 20 times higher percentage wise because of the lack of data flow.

    In working on my current network position I did find that they had been creating network printers with a direct connect to the ip address and then changing the ips and readding the printers again thus leaving the old ports configured in the pcs. And of course the pcs arp broadcast like crazy looking for the printer port even though it is not in use.

    Oh I know this is a very old thread but I wanted to leave this out here for anyone researching arp issues.

  11. #11
    Oops_my_bad's Avatar
    Join Date
    Jan 2007
    Location
    Man chest hair
    Posts
    1,738
    Thank Post
    438
    Thanked 53 Times in 50 Posts
    Rep Power
    31
    Quote Originally Posted by drewp View Post
    As I understand it at the moment VLAN's will only allow data to pass between the ports configured in the VLAN and not other ports on the Switch.
    That's correct, unless you seriously mis-configure your VLANS. Had this problem in my current job - previous network manager left everything on defaults and default vlan 1 was carrying other vlans!



SHARE:
+ Post New Thread

Similar Threads

  1. Using Aim High with SIMS for reports
    By Opensource in forum MIS Systems
    Replies: 4
    Last Post: 24th January 2008, 10:18 AM
  2. High Capacity Printer.
    By boomam in forum Hardware
    Replies: 19
    Last Post: 8th November 2007, 05:18 PM
  3. tour of you high school-primary
    By callumtuckey in forum General Chat
    Replies: 9
    Last Post: 12th June 2007, 12:43 AM
  4. High density wireless
    By timfletcher in forum Wireless Networks
    Replies: 9
    Last Post: 17th January 2007, 06:51 PM
  5. High Spec Laptop
    By alan-d in forum Recommended Suppliers
    Replies: 23
    Last Post: 10th June 2006, 03:09 PM

Thread Information

Users Browsing this Thread

There are currently 1 users browsing this thread. (0 members and 1 guests)

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •