Customer login  |   Contact us
Home Company Products Support Purchase
Forum Home » Network Probe

Topic: ARP Storm
Replies: 3   Pages: 1   Last Post: Nov 10, 2004 3:54 PM by: Eivind Pedersen


Back to Topic List Back to Topic List
Replies: 3   Pages: 1  
jjenkins

Posts: 8
From: Milwaukee, WI
Registered: Nov 5, 2004
ARP Storm
Posted: Nov 9, 2004 10:28 PM
  Reply

It looks like I may be having a broadcast storm on one of my remote networks.

Would I be able to use Network Probe to help determine this?

On a somewhat similar note, does anyone know of a Windows based utility that can help detect duplicate IP addresses on a subnet?

Thanks.

Eivind Pedersen

Posts: 473
From: Oslo, Norway
Registered: Jun 11, 2002
Re: ARP Storm
Posted: Nov 10, 2004 10:29 AM
  Reply

Yes, Network Probe detects all traffic. Most likely you will see a large amount of "ether.ARP" traffic.

jjenkins

Posts: 8
From: Milwaukee, WI
Registered: Nov 5, 2004
Re: ARP Storm
Posted: Nov 10, 2004 2:50 PM
  Reply

I have sent the probe out to that remote network.

Am I correct in that I would then check the conversations for the ARP protocol?

What is the best way to then determine the cause of the ARP storm?

Eivind Pedersen

Posts: 473
From: Oslo, Norway
Registered: Jun 11, 2002
Re: ARP Storm
Posted: Nov 10, 2004 3:54 PM
  Reply

Right-click on the "ether.ARP" protocol in the protocol table, choose "Show conversations using this protocol". Sort on bytes or packets, and the source host for the top entry is most likely causing the problem.



© 1998-2019 ObjectPlanet, Inc. Øvre Slottsgate 5, 0157 Oslo, Norway Tel (+47) 2233 3360 | Fax (+47) 2233 3361