Ethereal-users: [Ethereal-users] Excessive Arps on my network

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

From: "Krahnke, Kurt" <Kurt.Krahnke@xxxxxxxxxxxx>
Date: Tue, 10 Aug 2004 10:00:29 -0500
I have downloaded and installed ethereal on my network and have begun to 
do some analysis of packets going over my network.  I am seeing anywhere
from 65 to 85% arps.  These are coming from several workstations on my
network
and they are all sequential.  I see the arp starting at a work station that
has an
ip address of 172.16.104.45, it arps to every ip address range in the
172.16.104.xx
range.  This means from 1 to 254, with the exception of 45?  I have never
seen this before,
do you have any idea what this may be?
	At first I thought it was the Welchia virus, we use Symantec
corporate anit-virus
which picked up nothing.  I downloaded and used Trend-micro's house call
encase the
anti virus was disabled, this also showed no viruses.  Have you seen this
before?
Is this possibly a spy ware running on my network?  Are there any
suggestions you
could give me to try and solve this problem?

Kurt Krahnke
Network Engineer
Treasure Island Resort and Casino
651-385-2843 direct
800-222-7077 ext 2843 toll free