Sometimes a botnet (or whatever) tries to port scan pretty much all IPs in the internal network (two /21 subnets) in one second. As a result the router sends out a lot of ARP requests and some slower switches get "clogged" - sometimes ping inside the LAN becomes 4 seconds or packets are lost altogether.
I have read that I could use arpd to cache negative entries (host is offline) and not resend the request each time a packet for that host comes in. However, I could not make it work.
arpd -a 5 -n 60 -R 20 -B 10 -b /var/arpd/arp.db -k eth1
Suppresses all broadcast ARP requests - no matter how long it has been since last check. Without the "eth1" option, the broadcasts continue as before. Setting /proc/sys/net/ipv4/neigh/eth1/app_solicit to 3 does not change anything.
The distribution is CentOS 6.4 with a custom kernel (3.7.10 with ipset and imq support). I have recompiled it to add CONFIG_ARPD.