2

My subnet is 10.162.0.0/16.
We have a router with a couple of interfaces.
Gateway for my subnet is 10.162.0.1.
The router is situated in another building and I haven't direct access to it. Line from router comes to my main layer-2 switch D-Link DES-3550 (10.162.0.250) and other part of subnet are connected to this switch.
Network works well for a short period of time ( 5 - 20 minutes) and then starts "attack" and it cyclic repeats.
How "attack" looks:
through Wireshark I can see router(10.162.0.1) incessantly ARP requesting one or couple addresses from my subnet such as

10.162.0.1 Broadcast ARP 60 Who has 10.162.8.75? Tell 10.162.0.1

But when i try to ping addresses, for which router request ARP, they don't answer, so they are not online, or maybe we even haven't such addresses.
I have aasigned one of the addresse, which was ARPed, to my computer. My machine answered to ARPs and sent my mac. But router didn't care and continued sending ARPs.
Router send about 10.000 - 25.000 ARPs per second. So it is impossible to even ping 10.162.0.1 from any computer of my subnet. Some times my main switch (10.162.0.250) don't answer on ping or delay about 3 sec.
Attack stops when i reboot my switch (10.162.0.250) or disconnect some it's ports (in the most cases disconnecting 10 and 11 ports helped, so maybe something happens there). When the next in turn attack starts the ARP requests are already other. It seems to randomly choose addresses to ARP.

Why router can send ARPs ? Can it be a comuper from other subnet attacking router? If the source is a computer from our subnet, then why the router sends ARP (can't understand this) ? How can i solve it? Thanks.

  • 1
    What was the final solution to your problem? – Mike Pennington Jun 21 '12 at 22:56
4

Check if you have a loop.

When a switch recieves a broadcast packet (like ARP), it sends it out through all ports. If you have a looped cable (from one port to another in the same broadcast domain), that packet comes back to the switch, and is broadcasted again through all ports (and comes back again, and again,...).

So basically, check if you have a cable going from one port to another on the same switch, or to another switch connected to the first one, and disconnect it. If you have managed switches, you should enable (r)STP to avoid such issues - with STP enabled, you can actually achieve redundancy with a loop - but when all is functioning correctly, one connection will be disabled by the switch itself).

1

Your problem is not that the router is ARPing at 25,000 packets per second, you have a loop in your ethernet layer2 topology.

If you are running spanning-tree, this is a decent start to block the loop, but some conditions can cause spanning-tree to allow loops to form (such as a unidirectional ethernet link, which drops BPDUs).

You need to find where the loop is. Very often it is on someone's desk or in a conference room where someone bridged two segments together with a hub.

Be sure you have configured Rapid Spanning-Tree or Multiple Spanning-Tree properly on all your switches. Storm-control is helpful, if your switch supports it.

0

Well, I have used binary search :) Sequentially disconnected ports in my main switch (10.162.0.250). So I found out the number of the floor, where the problem was. Then doing the same actions with the switches on the floor I found the room. I haven't found any loop.
And turned out that one Wi-Fi router was breaking down all my network. I haven't recently explained why it had done this. Because all unnecessary functions were turned off , actually it worked as a wireless switch ( as a bridge ). Have you any suppositions about it?

  • The most likely cause is that someone is using the wifi in infrastructure mode on more than one point of your network and spanning-tree is not blocking the loop – Mike Pennington Jun 22 '12 at 1:35
  • You mean someone connected to two different Access Points simultaneously? – Temak Jun 22 '12 at 10:10
  • 1
    Yes their wifi in infrastructure mode, or they bridged two LAN segments with one of the APs. Sometimes people do things like offering "alternatives" to your office internet access – Mike Pennington Jun 22 '12 at 10:21
0

Had the exact same problem. 20,000+ ARP requests. No loop in network. Cause was a lightening strike power spike that messed up the router. Replaced the router and the problem went away.

0

The router could be checking for unknown/self-declared IP addresses in its range of DHCP entries, but more than likely you have a device trying to communicate with the IP address 10.162.8.75 at a fast rate and your router is trying to find that address.

I had a case in which the router was spamming a range of ARP requests for IP addresses that didn't exist on the LAN (10.0.0.30-10.0.0.50). I suspected that a device on the network was trying to communicate with those IP addresses. I mirrored the Ethernet traffic between my switch and router to another port to monitor all requests from the wired LAN to the router. The culprit ended up being a Canon Printer/Scanner network utility that was hammering the router for requests to these IP addresses that did not exist.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.