Hey Folks,

Have a lil problem and hope someone can point out a solution/explanation. Today afternoon, there was some sorta flooding on the network. A number of hosts on my 172.16.0.0 network were sending out ARP broadcasts sequentially for all 65K machines on the B-Class. One machine would start that.. bcasting ARP for some range such as 172.16.99.100, 101, 102... and so on. Then it would stop and another machine would start up the same process. The source machines sending out these packets were seemingly random.

a) Is there a legitimate application that can cause this kind of extensive ARP requests? Doubtful, since the behavior was occuring on a number of source machines
b) Some worm on all those source machines?
c) I'm being stupid, and its just something in the Windows TCP/IP stack..

Hope you folks would have some advice. My experience is presently very limited [graduated only 2 weeks ago and took up this Network Support position in the university]

Thanx in advance,

Scim

-----

Just an update to this post:

Its definitly not a legitimate application, the ARP flooding is still going on, and its no more a flood, its effectively saturated the network. Again, any help would be really appreciated.

Scim