PC sends repeated ARP requests to Default Gateway

Question

CONTEXT: My machine, for whatever reason, is flooding the network with ARP requests. A downstream switch sees this as malicious and cuts my connection. I've narrowed it down to one of the dozen or so applications I run, but I'm still filtering through it.

The machine: hand-built Win10 desktop, using an Asrock mobo with built-in gigabit jack. (D0:50:99:...)

The question: I still see repeated requests for the owner of my Default Gateway. I do see a response come in, and filtering through the local ARP table via arp -a I see it gets stored away. However, it still sends out another request three seconds later, without fail. Is this intended behaviour, or is there still something running that's screwing me up?

---

UPDATE: Silly me - I've only been checking my own NIC's connection to upstream, and didn't bother looking at what my neighbors were doing. They're all doing the same, which makes me believe this is a quirk of the specific hardware my school is using.

Solution

So from the troubleshooting, I'm going to put this as the answer, but there are going to be a few things to try to reset your NIC.

In this case, we know your ethernet NIC is causing the problem, because your Wifi works fine and doesn't send ARP requests as often. You will need to reset your NIC or update the driver.

• If you can update the driver first, do that, generally you will check with whoever you bought the computer from (Dell, HP, etc.) or the motherboard's website.
• If you haven't yet, clear the ARP cache by running command prompt as an admin, then run the command arp -a -d which will delete all ARP entries (do arp -a to double check).
• Check for any old network drives or devices (printers, scanners, etc.) and remove any old devices/drives that are not used/do not exist.
• Assuming nothing else is trying to look for an address on your network, you may want to try to reset the NIC by opening Command Prompt as admin, then run netsh winsock reset

If those do not work, then on the WireShark entry, it should say "Who has (address)? Tell (address). Tell me each unique entry you see within 1-5 minutes, just in case it's something else.

Comments

[dakre18]

So just to check, if you disconnect your computer from the network, the ARP requests stop flooding the network? I assume you've check that, otherwise you wouldn't say it's only your computer. Generally ARP requests come from your NIC, because it needs to find the physical location (MAC) of the computers on the network or the PC it is trying to access. So if you have a second NIC you can try, i would suggest doing that to make sure your NIC isn't causing the problem. Updating drivers may be a good option if that's the case. Edit: i was just thinking, did you try an arp -a -d?

[sctjkc01]

I've been using Wireshark, and am certain that the excess ARP requests are coming from my machine. I don't have access to another NIC on the machine, but I should probably check both a WiFi dongle and a Raspberry Pi. I'll get back to you once I've got things to share.

[dakre18]

That would be great, since those would be separate NICs. Also if you are using wireshark, the Wifi should have less ARP requests, but if you can check, in Wireshark, one of the fields it gives you has data on what computer it's requesting information on. I don't remember which one, since it's been a while. However, you should see the MAC and/or IP for your computer's NIC, the default gateway or switch, and then either the IP or Host Name for the computer it wants information on. Check if that computer is always the same.

[sctjkc01]

Dakre - I know for certain my PC (I've checked my MAC vs the source MAC) is broadcasting (to FF:FF:FF...) a request for my default gateway's IP, every three seconds. The packets are identical.

[sctjkc01]

dakre18 - Just plugged my Wifi Dongle in, and don't see anywhere close to the same number of ARP packets. The other NIC is disconnected at the moment - I'm capturing from it as well and I don't see anything coming through it. Also worth mentioning: I dropped Wireshark on my Pi. I can't seem to capture packets off the Ethernet jack on it, so I'm SOL on that front. Wireshark on my PC doesn't see anything from it.

[sctjkc01]

* I want to say that my NIC's drivers were checked recently. I can't say for certain, but that was a step taken when trying to diagnose the ARP flood in the first place. * Already done, several times, no change. * Don't have any old stuff, this PC's rather new. * Not entirely certain what that'll do, considering that I don't own any of the upstream networking gear. * As far as what I'm seeing from WireShark, there's very little by unique entries. It's either me asking "Who has .254 (upstream router)? Tell .161(my IPv4)" or someone asking "Who has .161(my IPv4)? Tell (them)"

[dakre18]

netsh winsock reset resets some of the NIC configurations, and can help if there's a problem with the NIC. Some people will tell you the NIC is bad, but it's hard to tell if a NIC is bad. In some cases i've seen where you need to uninstall the ethernet driver completely, then reinstall it. In your case, if those don't work, i would hate to say you may have to replace the NIC. That would obviously be to talk with ASRock and explain what is going on, but I don't know how good their customer support is. I'll see if I can come up with any other options, because replacements can be a pain.

[dakre18]

I forgot to ask, but did you try plugging in your computer directly into the primary modem/router/firewall? Especially the one that is asking for your MAC. That would be easier than removing hardware between the two. Or is it connected directly into the router?

[sctjkc01]

dakre - it's a bit hard to try that, because this is the setup I've got: PC -> Switch -> Wall -????-> Internet. Campus networking ftw. I can at least remove my switch from the equation, one tick.

[sctjkc01]

Currently direct-to-wall + did netsh winsock reset. No change. However, considering the machine is doing well enough as is, it doesn't seem to be harming anything (especially true, because I just now noticed everyone on subnet is doing the same).

[dakre18]

Yeah, ARP requests are sent out occassionally, but generally you will see it checking different IPs each time. It definitely won't hurt it, unless you get an actual ARP Storm, and that will include more than 1 computer.