Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I've read that it's fairly normal to have several ARP requests per second on the network, but was curious if someone could elaborate on the "why" I would have so many versus not? Over the course of 4 seconds I see about 40 arp requests, right about 10 per second, and all reqeusts seem to be from valid IPs on our network with a known server or PC. Is that many normal? If so, what is the purpose? I've never thought much of it thinking that since it wasn't several hundred a second it was "ok", but my boss recently looked at network monitor and saw them and said that at his previous job they didn't have that many requests, and the network was much larger than ours currently is. So I was just hoping someone could explain to me a bit more about this and if it's anything I should be concerend about or check more deeply into. I definitely want to avoid any network congestion that I can, to allow the network to run as smoothly as possible. Thanks in advance.

share|improve this question
up vote 3 down vote accepted

Grab a five second sample and analyze them. Are lots of them looking for IPs that aren't populated? If so, which machines are sending them? Are there repeats? Is each one for a legitimate pair of machines you'd expect to be talking to each other.

Once you have a good statistical feel for what's going on, you can look at why it's happening. Most likely, it's perfectly legitimate. But if you need to know, the first thing you need to do is a good solid understanding of what the traffic looks like.

share|improve this answer
The traffic seems to be legitimate in the fact that they're from/to PCs and servers I would expect to be talking. Out of 51 lines of capture, about 12 are not ARP requests, the non-ARP are IPX, a few UDP and a couple Netbios (which seem to be pointing to .255 of our subnet, something else to look at I guess). So I guess I can assume everything is fine as less than 40 ARP in 5 seconds should be "normal". – Don Dec 19 '11 at 15:27
I agree. It seems like it's just normal traffic. – David Schwartz Dec 19 '11 at 15:34
Thanks for everyone's input! – Don Dec 19 '11 at 17:23

There are way too many variables at play here to compare your current network to the "large" network your boss had experience with previously.

40 ARP requests per second is nothing, not even worth thinking about. Once you start seeing thousands per second, then you need to look into what's going on (most likely a L2 loop somewhere).

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.