Just a tip Scimitar,
ARP flooding has 2 main impact on the LAN segment flooded:
1- waste of bandwidth (this one is obvious).
2- the switch can't switch and is just like a hub flooding every unicast frames.
most commonly for an ease of use reason switche are configured with MAC address self learning mecanism.
In that case, the ARP flooding will cause a CAM overflow that will bring down the switch capability to a simple hub (no more switching coze switch have not an unlimited number of CAM enties obviously).
Temporary Counter Measures:
1- many switches (CISCO, Alcatel) have a broacast storm mitigation function per port based on treshold. (e.g. drop broadcast frames when rate > 100 frames per seconds).
this is very usefull and should always be enabled on port were PC or hubs are directly connected.
This could be quite painful to set it up if you have many users & switches connected to your network but some (expensive) management tool specific to your switches can ease the work. And once its done that would not occur again.
2- Disable self learning mechanism, but that a real pain in the ass to config... Especially when you add/remove terminals....
To look at the cause I'll advice you to search for dsniff progz installed on PCs generating frames (If you find some remove them....)
Godd luck...




Reply With Quote