General discussion

Locked

Gratuitous Arp broadcast

By aaronm ·
I work in the IT department for my home county. We have 16 servers with 10 of them running Windows 2000 server, and the other 6 running Windows Server 2003. The other day I was using ethereal to monitor traffic on the LAN and I noticed that two of my Server 2003 boxes were broadcasting a gratuitious arp message asking "Who has 192.168.30.32?" That IP address does not exist in my network, and I have not been able to figure out why those messages are being broadcast every two seconds from those two servers. Any thoughts would be appreciated.

This conversation is currently closed to new comments.

4 total posts (Page 1 of 1)  
| Thread display: Collapse - | Expand +

All Comments

Collapse -

RRAS

by curlergirl In reply to Gratuitous Arp broadcast

Assuming your local IP subnet is 192.168.30.x, the ".32" address is usually automatically assigned to the RRAS virtual adapter on any Windows 2K or 2K3 server. If you have (or at one time had) a multi-homed RRAS server on your network, it may have registered this IP address in DNS which should not have happened but does happen frequently if the RRAS server only has one NIC. Check out your DNS entries and see if this IP appears there. If not, it may have already been corrected, and you could just clear the ARP cache on those servers and then double-check to be sure it doesn't reappear. Or, conversely, if you don't need or want an RRAS server on your network, find the server that has it installed and configured and remove it.

Hope this helps!

Collapse -

FAILING HARDWARE

by rmjivaro In reply to Gratuitous Arp broadcast

I had this exact problem.
Gratuitous ARP requests are sent out when a NIC comes up to allow other machines on the LAN to update their ARP tables (IP to MAC mapping). If excessive requests are sent out it indicates a NIC that is going down/up/down again. In other words, the hardware is failing. Replacing the NIC solved it for me. see http://wiki.wireshark.org/Gratuitous_ARP

Collapse -

Gartuitous Arp

by donald_woeltje In reply to Gratuitous Arp broadcast

A "Who has" is not a gratuitous arp. It's an arp request. Your system is attempting to send traffic to that address, for whatever reason, and to do so (since the packets get delivered via MAC address) your system bust be able to associate this IP address with the machine that has the link address (MAC address) associated with that IP address. It first looks through it's own arp cache to see if such an entry exists. If not, it sends out an arp request (a "who has") to find out which MAC address is associated with that IP address. If it gets no reply (meaning that system is not on that network), it will send the arp request to the gateway (router) to be forwarded for further resolution attempts.

The 192.168.0.0/16 address space is a private, publicly-unroutable address space commonly used in private networks that are either completely private (unconnected to the Internet) or are seperated from the Internet by a firewall or someother similar technology.

A Gratuitous Arp is an arp announcement made by a system to tell the other systems on the network that this system has such and such an IP address associated with such-and-such a MAC address (I suppose you could sort of call it an unsolicited "I have", as opposed to a "who has")

Collapse -

Problem solved.

by pkurr In reply to Gratuitous Arp broadcast
Back to IT Employment Forum
4 total posts (Page 1 of 1)  

General Discussion Forums