Tooooo many ARP packets on network

[deepakna]

Hello,

Not sure if i should be asking this question in here or linux-security...

I have a strange problem in my network, ARP packets are being flooded into the network to the extent that sometimes the network chokes for a moment..as the below entries show every second there are 4ARP packets on the network and for every ARP packet there is STP(spanning tree protocol ) on the network, am using all linux machine in the office with 10.34.0.0/16 and not sure for where the 192.168.1.1 series is popping up on the network..Could somebody Pleaseeeeeeee help me resolve this issue.. Thanking you all in advance and any more info required on this please let me know.

root@inlogin001 root]# tcpdump -i eth0 | grep who-has
tcpdump: listening on eth0
19:00:50.298506 arp who-has 192.168.1.1 tell 192.168.1.10
19:00:50.848472 arp who-has ls.montalvosystems.in tell mboopathy.montalvosystems.in
19:00:50.858471 arp who-has pixin.montalvosystems.in tell mboopathy.montalvosystems.in
19:00:50.878470 arp who-has rdenduluri.montalvosystems.in tell ls.montalvosystems.in
19:00:51.948404 arp who-has ls.montalvosystems.in tell kharsha.montalvosystems.in
19:00:52.298382 arp who-has 192.168.1.1 tell 192.168.1.10
19:00:54.298258 arp who-has 192.168.1.1 tell 192.168.1.10
19:00:56.298135 arp who-has 192.168.1.1 tell 192.168.1.10
19:00:58.298011 arp who-has 192.168.1.1 tell 192.168.1.10
19:01:00.297888 arp who-has 192.168.1.1 tell 192.168.1.10
19:01:02.297764 arp who-has 192.168.1.1 tell 192.168.1.10
19:01:03.207708 arp who-has collector.montalvosystems.in tell mitsrv01.montalvosystems.in
19:01:04.297640 arp who-has 192.168.1.1 tell 192.168.1.10
19:01:06.297517 arp who-has 192.168.1.1 tell 192.168.1.10
19:01:07.027472 arp who-has pdcin.montalvosystems.in tell RameshSubbarao.montalvosystems.in
19:01:08.297393 arp who-has 192.168.1.1 tell 192.168.1.10

[deepakna]

This for the mirrored PIX port.....just a bit more info

[root@snooper ~]# tethereal -i eth1
Capturing on eth1
0.000000 00000000.0800372592b1 -> 00000000.ffffffffffff IPX SAP General Response
0.103702 Giga-Byt_e5:7b:fe -> Broadcast ARP Who has 192.168.1.1? Tell 192.168.1.10
0.773880 00:1a:92:2b:70:ca -> Broadcast ARP Who has 10.34.0.1? Tell 10.34.2.124
0.932634 FoundryN_87:9a:df -> Spanning-tree-(for-bridges)_00 STP RST. Root = 32769/00:0c:db:87:6e:10 Cost = 10000 Port = 0x802f
1.057887 IntelCor_d5:87:09 -> Broadcast ARP Who has 10.34.2.183? Tell 10.34.0.23
1.406644 10.34.0.53 -> 239.255.255.250 SSDP NOTIFY * HTTP/1.1
1.422914 10.34.0.53 -> 239.255.255.250 SSDP NOTIFY * HTTP/1.1
1.436901 10.34.0.53 -> 239.255.255.250 SSDP NOTIFY * HTTP/1.1
1.451834 10.34.0.53 -> 239.255.255.250 SSDP NOTIFY * HTTP/1.1
2.103475 Giga-Byt_e5:7b:fe -> Broadcast ARP Who has 192.168.1.1? Tell 192.168.1.10
2.932935 FoundryN_87:9a:df -> Spanning-tree-(for-bridges)_00 STP RST. Root = 32769/00:0c:db:87:6e:10 Cost = 10000 Port = 0x802f
4.103635 Giga-Byt_e5:7b:fe -> Broadcast ARP Who has 192.168.1.1? Tell 192.168.1.10
4.932766 FoundryN_87:9a:df -> Spanning-tree-(for-bridges)_00 STP RST. Root = 32769/00:0c:db:87:6e:10 Cost = 10000 Port = 0x802f
6.104811 Giga-Byt_e5:7b:fe -> Broadcast ARP Who has 192.168.1.1? Tell 192.168.1.10
6.932985 FoundryN_87:9a:df -> Spanning-tree-(for-bridges)_00 STP RST. Root = 32769/00:0c:db:87:6e:10 Cost = 10000 Port = 0x802f
8.104044 Giga-Byt_e5:7b:fe -> Broadcast ARP Who has 192.168.1.1? Tell 192.168.1.10
8.933671 FoundryN_87:9a:df -> Spanning-tree-(for-bridges)_00 STP RST. Root = 32769/00:0c:db:87:6e:10 Cost = 10000 Port = 0x802f
9.557296 10.34.2.219 -> 239.2.11.71 UDP Source port: filenet-pa Destination port: 8649
10.106019 Giga-Byt_e5:7b:fe -> Broadcast ARP Who has 192.168.1.1? Tell 192.168.1.10
10.932248 FoundryN_87:9a:df -> Spanning-tree-(for-bridges)_00 STP RST. Root = 32769/00:0c:db:87:6e:10 Cost = 10000 Port = 0x802f
12.105756 Giga-Byt_e5:7b:fe -> Broadcast ARP Who has 192.168.1.1? Tell 192.168.1.10
12.632525 Intel_0f:61:0d -> Broadcast ARP Who has 10.34.0.24? Tell 10.34.2.229
12.932862 FoundryN_87:9a:df -> Spanning-tree-(for-bridges)_00 STP RST. Root = 32769/00:0c:db:87:6e:10 Cost = 10000 Port = 0x802f
13.330512 10.34.0.54 -> 239.255.255.250 SSDP NOTIFY * HTTP/1.1
13.344944 10.34.0.54 -> 239.255.255.250 SSDP NOTIFY * HTTP/1.1
13.349675 10.34.0.54 -> 239.255.255.250 SSDP NOTIFY * HTTP/1.1
13.360465 10.34.0.54 -> 239.255.255.250 SSDP NOTIFY * HTTP/1.1
13.890095 AsustekC_dc:3d:f6 -> Broadcast ARP Who has 10.34.0.24? Tell 10.34.2.236
14.105199 Giga-Byt_e5:7b:fe -> Broadcast ARP Who has 192.168.1.1? Tell 192.168.1.10
14.316494 10.34.2.219 -> 239.2.11.71 UDP Source port: filenet-pa Destination port: 8649
14.316498 10.34.2.219 -> 239.2.11.71 UDP Source port: filenet-pa Destination port: 8649
14.316499 10.34.2.219 -> 239.2.11.71 UDP Source port: filenet-pa Destination port: 8649
14.698209 00000000.000e7fe8a1b0 -> 00000000.ffffffffffff IPX SAP General Response
14.932816 FoundryN_87:9a:df -> Spanning-tree-(for-bridges)_00 STP RST. Root = 32769/00:0c:db:87:6e:10 Cost = 10000 Port = 0x802f
16.103910 Giga-Byt_e5:7b:fe -> Broadcast ARP Who has 192.168.1.1? Tell 192.168.1.10
35 packets captured

--Deepak