0

This issue started when our third party support changed the subnet of our network since there are few IP addresses left. All of our workstations here are currently running on Windows 7 64-bit and now some of it have ARP.exe running on the task manager and it consumes a huge amount of CPU usage.

We've already restarted our unmanaged Cisco Switches to flush the ARP tables but still the issue persist.

2
  • How many devices are you talking? Does the 3rd party have any network or system monitoring tools on your computers? Have you spoke with them about this problem? Aug 15, 2017 at 4:01
  • You need to determine what the ARP traffic is before you can do anything else. On one of the affected machines run a packet capture and see what all of the ARP traffic is.
    – joeqwerty
    Aug 15, 2017 at 20:58

1 Answer 1

1
  1. Check whether this ARP.exe is the standard MS one, something the support guys installed, or something completely different (even malware).

  2. Check where it is started from (Sysinternals Process Explorer can tell you).

  3. Check out the command line (task manager or process explorer).

  4. Optionally, run Wireshark and check your network for unusual broadcasts.

  5. Report back with the results. Add details to your question.

Enlarging the subnet size involves all hosts getting the new network mask. The easiest way is by DHCP, static configs require manual intervention. For transition you can run a mixed setup but the hosts with the old mask require a gateway to the rest.

Unmanaged switches don't have an ARP table. Managed switches only use ARP for management traffic. Layer 3 switches require ARP when routing.

2
  • 1. I've already scanned the affected workstations and found nothing.
    – Viguro
    Aug 16, 2017 at 1:04
  • 1
    Is it C:\Windows\System32\ARP.exe? Signed by Microsoft?
    – Zac67
    Aug 16, 2017 at 7:31

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .