2

I have found out through Wireshark that a computer in my subnet scanning network ( sending ARPs for every IP-address in my subnet. Even if there no computers with such address).

It repeats infinitely. About 200 ARPs per sec from this computer.

10.162.4.41 Broadcast ARP 60 Who has 10.162.118.186? Tell 10.162.4.41

We have scanned this computer with several antiviruses and haven't found a malicious software.
What soft on computer can do infinite scanning?

Temak
  • 195
  • 1
  • 3
  • 11

2 Answers2

9

Normally I'd use Sysinternals tools like tcpview and procmon to see if there were any odd programs or activity on the system.

Nothing strange in the logfiles?

It's also possible that your network card or network card driver is wonky and may need to be replaced or reinstalled.

Is this happening regardless of who's logged in? If the machine is first booted up it just starts doing this while sitting at a login prompt?

Bart Silverstrim
  • 31,172
  • 9
  • 67
  • 87
1

Turned out that it was a program Connectify. But I don't' know the reason, why it was probing all the subnet, when computer was connected via wire.

Temak
  • 195
  • 1
  • 3
  • 11
  • 1
    It looks like it's the "Network Peer Scanning" feature in the software. Found that in the release notes, by Googling `connectify arp`. – mfinni Jun 21 '12 at 15:56
  • Yes, it is Network Peer Scanning: "Turning off Network Peer Scanning will make Connectify no longer detect web servers and shared drives on other computers, but will also prevent it from issuing ARP packets onto the network. Both options can be found in the Connectify Menu under Advanced Settings." But it is only from 3.4.0.23678 version – Temak Jun 21 '12 at 23:52