General discussion


ARP saturated network

By gchichester ·
What is the best way to determine the cause of an ARP saturated network?

Using my Fluke network monitor I will notice that ARP is running anywhere from 50% to 75%. While IP is around 30% to 50%. I can?t seem to find any rime or reason for this high ARP traffic. I comes and goes at random lasting anywhere from 2 min to hours.

We are currently a single NT4 domain with about 500 nodes running a mixed NT4 workstation & Windows 2000 Pro on a switched network, with both Netbeui & IP protocols active. We are also a part of Trust in a Active Directory.

This conversation is currently closed to new comments.

Thread display: Collapse - | Expand +

All Comments

Collapse -

by Oldefar In reply to ARP saturated network

A node will send an ARP packet whenever the IP of the destination is not in its local host cache. The cache entries time out, typically after 10 minutes in a MS environment, and a new ARP must be sent.

The good news is that the response to an ARP should go into every other node's host cache as well within a collission domain and so limit ARP for any specific host to no more than once every 10 minutes. Still, with 500 nodes that can mean an ARP rate of 50 per minute average and at times a much higher rate. In earlier versions, the entry was deleted in not used after 2 minutes.

Steps to take to lower your ARP rate. Look at the source of the request packets and check the cache time. ArpCacheLife is found in the HKEY_LOCAL_MACHINE\SYSTEM subtree, in the following key:


The parameter information is as follows:

Entry: ArpCacheLife
Range: Number of Seconds

In Windows NT version 3.51 Service Pack 4 or later the life can be configured.

You may want to set all the machines to a higher time, or simply the worst offenders.

Collapse -

by Oldefar In reply to

See the Microsoft Knowledge Base

or the TechTarget tips at

Related Discussions

Related Forums