File server generating excessive ARP's

Discussion in 'Networks' started by simongrahamuk, Sep 7, 2005.

  1. simongrahamuk
    Honorary Member

    simongrahamuk Hmmmmmmm?

    6,205
    136
    199
    Hi guy's I've noticed recently that traffic on my network seems to have been increasing, so I have installed and ran etherreal on a workstation.
    What I have noticed is that there seems to be a large amount of ARP requests coming from my file server, a lot more than I would have expected.

    Anyone got any ideas what would cause this? and some pointers as to how to resolve?

    :rolleyes:
     
  2. simongrahamuk
    Honorary Member

    simongrahamuk Hmmmmmmm?

    6,205
    136
    199
    Think that I've found what my problem is unfortunately as my server is already running the latest service pack I can't get a fix unless I contact MS. :dry
     
  3. eyeball

    eyeball Nibble Poster

    82
    3
    0
    Interesting to know...just checked our systems for this, they seem to be ok (thankfully). No plans for a SP2 for 2k3 at the moment so will just have to hope the hotfix is out soon. If it having a detramental (-sp?) effect on the network?
     
    Certifications: A+, Network +, MCSA
    WIP: CCNA, MCSE+security
  4. simongrahamuk
    Honorary Member

    simongrahamuk Hmmmmmmm?

    6,205
    136
    199
    Naa, everything is running fine.

    I'm just sick of the activity lights on the switches flashing away at me!!! :)
     
  5. d-Faktor
    Honorary Member

    d-Faktor R.I.P - gone but never forgotten.

    810
    0
    39
    so why don't you contact ms? i have contacted them many times for those 'contact-us-first' hotfixes. after which they usually send the download link within the hour. no questions, no costs.
     
  6. simongrahamuk
    Honorary Member

    simongrahamuk Hmmmmmmm?

    6,205
    136
    199
    I would, but to be honest it's not really that urgent an issue. As I've already said everything is up and running really well, so I can wait. 8)
     
  7. GeorgeZip

    GeorgeZip Bit Poster

    22
    1
    5
    Well I just tried to attach it to here but it's 700k.. If you want it ping me a mail and I'll send it to you.. The joy's of having premier support huh? :D
     
  8. GeorgeZip

    GeorgeZip Bit Poster

    22
    1
    5
    Hope that file helps Simon. :)
     
  9. simongrahamuk
    Honorary Member

    simongrahamuk Hmmmmmmm?

    6,205
    136
    199
    Thanks George. I'll try it out on Monday when I return to work and let you know.

    :)
     
  10. simongrahamuk
    Honorary Member

    simongrahamuk Hmmmmmmm?

    6,205
    136
    199
    Well, I tried to run the hotfix that George supplied me with this morning, but it appears that this hotfix was released before 2003 SP1, and as such was included in it.

    So it seems that what I thought was causing the problem is not necessarilly the cause. Anyone got any other ideas what causes ARP's to be generated?

    I have now noticed that around 65% of all network traffic is ARP's, with about 55% coming from the file server?

    NB: This still isn't a major problem as everything is running just fine, would just like to get to the bottom of it.

    8)
     
  11. eyeball

    eyeball Nibble Poster

    82
    3
    0
    Is the server caching properly, if not then it will be talking loads to fulfil the requests on it.
     
    Certifications: A+, Network +, MCSA
    WIP: CCNA, MCSE+security
  12. simongrahamuk
    Honorary Member

    simongrahamuk Hmmmmmmm?

    6,205
    136
    199
    Interesting. The thought occurs to me that you may be onto something, but where would I need to look to see if ARP's are being resolved properly, considering that this is only a file server and does not have any network services running on it.

    :blink
     
  13. piltze

    piltze New Member

    2
    0
    13
    Anyone find a resolution to this? I am experiencing the same thing.
     
    Certifications: MCSE, CCNA, CCVP, CISSP, S+
    WIP: CCNP\
  14. simongrahamuk
    Honorary Member

    simongrahamuk Hmmmmmmm?

    6,205
    136
    199
    Hi Piltze!

    Interestingly this is something that I had completely forgot about! :oops:

    Other things just got in the way, and as this was only a minor irritation I forgot about it.

    Haven't noticed if it's sorted itself out or not, I'll have to check when I get back to work tomorrow.

    Thanks for the 'Bump!' 8)
     
  15. piltze

    piltze New Member

    2
    0
    13
    Ok. Out of curiousity, did you check to see if it was possibly a worm/virus/trojan issue?
     
    Certifications: MCSE, CCNA, CCVP, CISSP, S+
    WIP: CCNP\
  16. Bluerinse
    Honorary Member

    Bluerinse Exabyte Poster

    8,878
    181
    256
    A couple of things Simon.

    ARP requests are quite normal and I would guess that the ARP traffic would depend on the amount of hosts in the subnet. How many hosts are on that segment?

    An ARP request/reply packet is only 28 bytes. They maybe making your switch lights flicker but I doubt you would suffer any loss of network performance.

    The ARP cache is refreshed every 20 minutes.
     
    Certifications: C&G Electronics - MCSA (W2K) MCSE (W2K)
  17. Clyde

    Clyde Megabyte Poster

    558
    15
    62
    er.. actually the arp cache stores data for 2 minutes, unless it's reused in that time whereupon it's stored for 10 mins...

    http://www.microsoft.com/technet/itsolutions/network/deploy/depovg/tcpip2k.mspx

    that said, if the requests are coming FROM the server, then the server is trying to resolve IP's. Ethereal will show those IPs. are the local or are they dodgy? If dodgy, could be spyware/virus possibly...
     
    Certifications: A+, Network+, Security+, MCSA, MCSE
    WIP: MCITP
  18. Bluerinse
    Honorary Member

    Bluerinse Exabyte Poster

    8,878
    181
    256
    Fair dinkums Clyde, I wasn't specifically referring to Microsoft's operating systems, but in this instance I should have.

    My source is here
     
    Certifications: C&G Electronics - MCSA (W2K) MCSE (W2K)
  19. Clyde

    Clyde Megabyte Poster

    558
    15
    62

    fair enough... he's right that its a predetermined timeout.. only in this case its as MS say... ah well, we both got something... looks like a nice source for me to bookmark, and you get to learn about MS arp!
     
    Certifications: A+, Network+, Security+, MCSA, MCSE
    WIP: MCITP
  20. Bluerinse
    Honorary Member

    Bluerinse Exabyte Poster

    8,878
    181
    256
    True, the learning never stops and I really appreaciate your assistance in that 8)
     
    Certifications: C&G Electronics - MCSA (W2K) MCSE (W2K)

Share This Page

Loading...
  1. This site uses cookies to help personalise content, tailor your experience and to keep you logged in if you register.
    By continuing to use this site, you are consenting to our use of cookies.