I have a system that consists of a control PC, two layers of switches, and 50 custom devices. The PC continuously streams a total of 5.8MB/sec (6000 ethernet frames/sec) to the devices.

I have discovered that each of the device endpoints is seeing all of this traffic, not just the traffic intended for that device. This is causing the firmware on the devices to choke a little.

My theory as to why this is happening is: The PC is set up with a static ARP table. The only times the devices send data is in response to ICMP echo or ARP requests. Since we do not ping the devices during normal operation, and since the PC's ARP table is static (and therefore no ARP requests are made), the devices never send any data and the switches never learn their MAC addresses.

Question 1: Is this analysis correct?

I have to solve this issue. There are four options:

  1. Manually configure the cam tables in all of the switches.
  2. Update the device firmware to periodically send something, thus updating the switches cam tables.
  3. Have the control PC periodically ping the devices, thus causing the devices to respond, leading to switch updates.
  4. From comments: Enable dynamic ARP on control PC, configure ttl to be less than that of switch entries.

So, question 2: Is option 1 the absolute right way to do this?

Now, the problem with option 1 is the switches in place are unmanaged and I cannot configure them. In order to use option 1 we need to replace the switches with managed ones. I believe this is worth it in the long run but right now it is not feasible for a number of reasons.

I do not want to use option 3 or 4 because I want the solution to this issue to be transparent to the control PC and for various other reasons (In particular, option 4 has subtle but noticeable performance issues in this application, described in the comments below).

Therefore I am pursuing option 2 right now. I've chosen to modify the firmware on each device to send gratuitous ARP requests with a broadcast MAC destination roughly every 30 seconds. I chose ARP because conceptually it seems the most appropriate, although I could also send e.g. blank ethernet frames. I chose the broadcast destination in the hope that the packet will pass the L2 switches and reach the L1 switches and cause them to update their tables as well.

Question 3: While this may not be the most correct option, will it work? Will sending gratuitous ARP requests periodically from all 50 devices cause any unexpected side effects? I do not know what the ttl is of the switch's cam table entries, I arbitrarily picked 30 seconds.

Question 4: Is there another option that I am not considering?

  • "The PC is set up with a static ARP table." Why would you do that?! That's like forcing full duplex in only one place. It leaves everything else blind and unable to work as designed. Feb 14, 2014 at 21:33
  • @DavidSchwartz The devices display video data and the server runs Windows 7. Without the static entries, the displays show visible glitches periodically as Windows clears and refreshes cache entries. Also we have full control over all devices and their MAC/IP addresses, there is no need to send ARP requests to get that information. In larger systems with 800+ devices there is no smooth way around it. It is a different topic. It is not the direct source of the problem here and is unrelated to the questions or solutions.
    – Jason C
    Feb 14, 2014 at 23:13
  • It is the direct source of the problem here. Without ARP replies, dynamic discovery of network topology is not reliable, but you are relying on it. Feb 14, 2014 at 23:16
  • A source; true. In this case that is essentially (sort of) the same as option 3 (periodic pings from the host) - it's only being done to get a response from the devices, not because the PC doesn't already have information about the MAC/IP addresses. Enabling dynamic ARP can be added as option 4 on the list but I'd like to avoid modifying host configuration and, more importantly, it introduces the performance issues I just mentioned. So: I'd like to not have the PC perform ARP requests and I'd like the switches to have valid cam entries. In any case the questions 1-3 above still stand.
    – Jason C
    Feb 14, 2014 at 23:22
  • 1
    That sounds good, though I don't like the ugliness of basing a device feature around a Windows problem. (It should be able to refresh the ARP cache without interrupting service.) But, hey, if it solves your problem and you can sell the wart as a feature, there's no reason to let the perfect be the enemy of the good. Feb 15, 2014 at 0:27

1 Answer 1


Problem: the Ethernet switches are flooding packets on all ports due to barren MAC tables and this traffic is causing problems for some devices.

Solution: As you already thought of: generate some traffic so the MAC tables get built. One way would be to have a network monitor program pinging each device. That would both get the MAC tables built and allow you to check if some devices are dropping off the network on occasion.

Note: removed an incorrect answer from getting sidetracked about ARP

  • Thanks. The thing is, the devices never send any data. I should have clarified that the control PC is streaming unicast data over UDP, not TCP, so there is no back-and-forth. The devices only send ethernet frames in response to ping or ARP requests, and neither of those are happening from the control PC. The PC doesn't broadcast data, its unicast, but the switches appear to be broadcasting the frames everywhere because their MAC tables are empty. The devices choke because, long story short, even frames with other destination MACs still bog down the hardware.
    – Jason C
    Feb 15, 2014 at 20:57
  • Thanks for the clarification. I got sidetracked in my original answer.
    – Brian
    Feb 15, 2014 at 21:23
  • Thanks for the edit. Good, that validates my thoughts a bit. Do you think pinging from the host is preferable to purchasing managed switches and manually populating the MAC tables, or modifying the devices firmware to periodically send some kind of data? The network layout and device MAC addresses are known and will not change (even if defective ones are replaced), I at least have that working in my favor -- the installation is completely static.
    – Jason C
    Feb 15, 2014 at 21:25
  • 1
    There are lots of existing network monitor programs that can do the pings, keep track of the results and do actions like send a notification if multiple devices are down. Likely the lowest work and least cost option.
    – Brian
    Feb 15, 2014 at 21:31

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .