My subnet is 10.162.0.0/16.
We have a router with a couple of interfaces.
Gateway for my subnet is 10.162.0.1.
The router is situated in another building and I haven't direct access to it. Line from router comes to my main layer-2 switch D-Link DES-3550 (10.162.0.250) and other part of subnet are connected to this switch.
Network works well for a short period of time ( 5 - 20 minutes) and then starts "attack" and it cyclic repeats.
How "attack" looks:
through Wireshark I can see router(10.162.0.1) incessantly ARP requesting one or couple addresses from my subnet such as
10.162.0.1 Broadcast ARP 60 Who has 10.162.8.75? Tell 10.162.0.1
But when i try to ping addresses, for which router request ARP, they don't answer, so they are not online, or maybe we even haven't such addresses.
I have aasigned one of the addresse, which was ARPed, to my computer. My machine answered to ARPs and sent my mac. But router didn't care and continued sending ARPs.
Router send about 10.000 - 25.000 ARPs per second. So it is impossible to even ping 10.162.0.1 from any computer of my subnet. Some times my main switch (10.162.0.250) don't answer on ping or delay about 3 sec.
Attack stops when i reboot my switch (10.162.0.250) or disconnect some it's ports (in the most cases disconnecting 10 and 11 ports helped, so maybe something happens there). When the next in turn attack starts the ARP requests are already other. It seems to randomly choose addresses to ARP.
Why router can send ARPs ? Can it be a comuper from other subnet attacking router? If the source is a computer from our subnet, then why the router sends ARP (can't understand this) ? How can i solve it? Thanks.