0

I have a Windows Server 2008 R2 domain controller and a bunch of workstations of various versions of Windows - XP SP3, Vista, 7, 8.1. Time sync wasn't working correctly on a few PCs so I followed the directions found on this page: http://techlauve.com/how-to-time-sync-across-windows-network/ to apply a GPO to make the server sync time with a NTP source (I used pool.ntp.org instead of the old Windows Time server), and another GPO to make all the workstations sync with the DC.

Some workstations were already syncing with the DC so I figured this would be pretty smooth.

Well, was I ever wrong. I force-updated a few workstations (gpupdate /force) and they worked fine, showed the server as the time source (yay), and so I went back to what I was doing before. Two hours later... all hell broke loose.

Basically all of my workstations that are newer than Windows XP are now flooding the network with ARP requests. To get on the internet to type this I had to unplug 95% of the workstations from the switch in the server room.

I ran wireshark on this machine (Windows 7 SP1 64-bit) and it's full of exciting data like:

Broadcast ARP 60 Who has 192.168.1.1? Tell 192.168.1.51
Broadcast ARP 60 Who has 192.168.1.53? Tell 192.168.1.50
Broadcast ARP 60 Who has 192.168.1.2? Tell 192.168.1.48
Broadcast ARP 60 Who has 192.168.1.253? Tell 192.168.1.51
Broadcast ARP 60 Who has 192.168.1.1? Tell 192.168.1.53

Plus thousands and thousands and thousands more lines like that in the span of minutes.

192.168.1.1 is the router/firewall. 2 is the server, .253 and .254 are network printers (HP somethings), everything > 30 and <200 is a workstation.

What on earth did I do wrong???

Thanks for any help.

Edit: further discovery. Changing the group policy for the workstations so they pull time directly from pool.ntp.org instead of my server resulted in the PCs that received the updated group policy stopping flooding the network. This still does not answer why "time from server = ARP flood" though, and I'd rather have all my workstations sync to my server instead of external time sources.

Plus, I have some older workstations that are so busy shouting their ARP requests that they can't pull in new group policies.

Thoughts?

3
  • 2
    Why do you think changing the Time configuration is the cause of the arp flood, and not something else?
    – Zoredache
    Jul 18, 2014 at 22:38
  • I also don't see how this would be related to ntp changes. Looks almost like they're repeatedly trying to do network discovery/mapping for some reason. Jul 18, 2014 at 22:45
  • Yeah, I wouldn't think so either, but I left a part out of the original question (which I will edit in in a second). I changed the group policy slightly to make the workstations pull directly from pool.ntp.org instead of the server... and the one workstation that was not flooded enough to actually receive a new copy of the group policy stopped flooding the network. Now I just need to figure out how to get the rest of them to stop flooding, because some are too busy flooding to get a new copy. Still don't know why server time = flood though.
    – evilspoons
    Jul 18, 2014 at 23:20

1 Answer 1

1

Turns out the answer is... nothing really at all to do with the group policy or time setting specificilaly.

It's the classic "user connected two ends of the same network cable to a switch" shenanigans, causing repeating ARP packets. I noticed when I started powering machines down and an office with zero powered-on machines had 3 active lights on a switch - one for the connection to the rest of the building, and two for... mystery!!

The time sync probably only exacerbated the problem by sending out more packets per second than an idle computer would otherwise. I don't have an explanation for why changing to pool.ntp.org vs my server made everything less screwy, but it certainly allowed me to connect when I couldn't before.

Blah.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .