1

I am seeing too much ARP 60 packets from one IP in wireshark. Our LAN is getting too slow, But the internet is working fine without any issues. But cant access local printers, file share etc

Am attaching the image with this. Is it normal to have like this ? or what else be the cause of network problem. How to find ?

enter image description here

Muneeb K
  • 111
  • 1
  • 1
  • 3

2 Answers2

1

ARP broadcasts alone - even in somewhat significant quantity - aren't necessarily indicative of a problem.

Without timestamps we don't even know if this is genuinely a high rate. If you are exceeding say 20 broadcasts a second from a specific origin you might have a problem.

All that being said, just taking the sample you have here you can try determining which computer is 192.168.21.75 and take it offline, see if it changes your behavior.

Tim Brigham
  • 15,545
  • 10
  • 75
  • 115
  • Is there any way to block from firewall (fortigate) or even from the system. Actually its too much of broadcast from that system. When we disconnect the cable, Yes network was fine. – Muneeb K Aug 08 '19 at 08:39
0

I agree with Tim, but one other thing that needs to be considered is how do you quantify that your LAN is "slow"? If you have old computers or 10/100 switches and network adapters, those will be your bottleneck. Upgrade to all gigabit and don't daisy chain unmanaged switches all over the place and you should be fine. Run proper gear for your environment's requirements and just don't look at the symptom but the entire architecture. Still slow on gigabit on a file transfer? Look at the underlying storage and upgrade it to something faster or SSD's. It could also be corrupted antivirus definitions or improper configuring of your AV solutions or a hard drive starting to die.

Brad
  • 250
  • 1
  • 11
  • Yes, we are planning to do that and create VLAN's.. But it will take some time for us to identify the cables and all. In mean while we need to find this issue and fix it. – Muneeb K Aug 08 '19 at 08:40