I had been monitoring our LAN setting due to slow bandwidth. In the wireshark, I am seeing an ARP request that is never resolve to a MAC address from the same IP address. I did a NMAP scan, the requested IP address is not on the network. Does anyone have a suggestion to what might be causing the excessive ARP request? Also, would it drastically drag down bandwidth?
2 Answers
You need to check ARP request source address and search for application making requests there.
Under normal operation a host will not ARP for an ip address that is not in the same subnet. If you have a host that is ARP'ing for an ip address not in the same subnet that is a pretty good indication of a malware infection. You need to isolate and inspect the host that is the source of the ARP traffic. You can get the ip address and MAC address of the ARP source from your Wireshark capture.
