If you see a lot of ARP traffic from a single machine, looking for MAC addresses for many of the IP addresses on your local network, there might be a virus on your network that's scanning your network for machines to infect. It's been claimed that the Wootbot virus does this.

This is not limited to Wootbot - i have observed during nachi outbreak networks very flooded with random arp and icmp requests which was very hard on L2/L3 devices - Anith Anand

-updated 6th Mar 05 (NetworkFlooding)

It is not just worms and viruses that can bring down the network or firewall - recently i was troubleshooting slow production network problem for a large organisation - intially i suspected it as some kinda virus outbreak or ddos attacks ..however thanks to wireshark - when i port spanned the firewall interfaces i noticed as much as 300,000 packets per min (5000 udp packets per second) in addition to the regular traffic was traversing through firewall (checkpoint) on single interface ( double it for exit interface) which made it bleed badly - even simple ping across f/w interface will timeout during this event - the above traffic was created by faulty (or mis configured) syslog listenter service which was pumping those error messages - however i should also thank "pathping" utility found in XP as it helped me in zooming into the problem by providing RTT and Packet Drop rate across network use pathping with -n option to make it work for you faster - "Anith Anand"

ArpFlooding (last edited 2008-04-12 17:50:22 by localhost)