ARP incomplete on the router connected to the gateway
Here in my office we have a network consisting of the gateway (router) from the ISP, and less than 15 clients (computers). I noticed the network slowed down a lot,
even when there was only 1 client connected, then I found out that the ARP table is filled with incomplete requests. All the incomplete requests are IP addresses which do not exist in the internal LAN. Because of this even pings from a computer (internal) to an outside network will start dropping. Can anyone help me understand what might be the issue? Exclude the case of loop because I tried to use it with one PC also.
networking arp
edited Dec 17 '18 at 16:44
Spiff
76.8k10117163
asked Dec 17 '18 at 16:31
BirukBiruk
11
|
show 4 more comments
Here in my office we have a network consisting of the gateway (router) from the ISP, and less than 15 clients (computers). I noticed the network slowed down a lot,
even when there was only 1 client connected, then I found out that the ARP table is filled with incomplete requests. All the incomplete requests are IP addresses which do not exist in the internal LAN. Because of this even pings from a computer (internal) to an outside network will start dropping. Can anyone help me understand what might be the issue? Exclude the case of loop because I tried to use it with one PC also.
networking arp
edited Dec 17 '18 at 16:44
Spiff
76.8k10117163
asked Dec 17 '18 at 16:31
BirukBiruk
11
You sure there's only one device? It sounds like something is spamming the network with bad requests for an IP maybe...
– djsmiley2k
Dec 17 '18 at 16:37
Incomplete ARP entries will have the IP address but missing the MAC address. Which IP addresses do you see on these entries and how do they relate to the network?
– harrymc
Dec 17 '18 at 17:09
The ip address are address which are on the same subnet but not occupied by the computers
– Biruk
Dec 17 '18 at 17:30
Do you have any switches on the network? (Please add in comments the name of the person addressed, like@harrymc:)
– harrymc
Dec 17 '18 at 17:42
It sounds like something is scanning your network. It could be a user or malware.
– Ron Maupin
Dec 17 '18 at 19:02
|
show 4 more comments
Here in my office we have a network consisting of the gateway (router) from the ISP, and less than 15 clients (computers). I noticed the network slowed down a lot,
even when there was only 1 client connected, then I found out that the ARP table is filled with incomplete requests. All the incomplete requests are IP addresses which do not exist in the internal LAN. Because of this even pings from a computer (internal) to an outside network will start dropping. Can anyone help me understand what might be the issue? Exclude the case of loop because I tried to use it with one PC also.
networking arp
edited Dec 17 '18 at 16:44
Spiff
76.8k10117163
asked Dec 17 '18 at 16:31
BirukBiruk
11
Here in my office we have a network consisting of the gateway (router) from the ISP, and less than 15 clients (computers). I noticed the network slowed down a lot,
even when there was only 1 client connected, then I found out that the ARP table is filled with incomplete requests. All the incomplete requests are IP addresses which do not exist in the internal LAN. Because of this even pings from a computer (internal) to an outside network will start dropping. Can anyone help me understand what might be the issue? Exclude the case of loop because I tried to use it with one PC also.
networking arp
networking arp
edited Dec 17 '18 at 16:44
Spiff
76.8k10117163
asked Dec 17 '18 at 16:31
BirukBiruk
11
edited Dec 17 '18 at 16:44
Spiff
76.8k10117163
asked Dec 17 '18 at 16:31
BirukBiruk
11
edited Dec 17 '18 at 16:44
Spiff
76.8k10117163
edited Dec 17 '18 at 16:44
Spiff
76.8k10117163
edited Dec 17 '18 at 16:44
Spiff
76.8k10117163
76.8k10117163
asked Dec 17 '18 at 16:31
BirukBiruk
11
asked Dec 17 '18 at 16:31
BirukBiruk
11
asked Dec 17 '18 at 16:31
BirukBiruk
11
11
You sure there's only one device? It sounds like something is spamming the network with bad requests for an IP maybe...
– djsmiley2k
Dec 17 '18 at 16:37
Incomplete ARP entries will have the IP address but missing the MAC address. Which IP addresses do you see on these entries and how do they relate to the network?
– harrymc
Dec 17 '18 at 17:09
The ip address are address which are on the same subnet but not occupied by the computers
– Biruk
Dec 17 '18 at 17:30
Do you have any switches on the network? (Please add in comments the name of the person addressed, like@harrymc:)
– harrymc
Dec 17 '18 at 17:42
It sounds like something is scanning your network. It could be a user or malware.
– Ron Maupin
Dec 17 '18 at 19:02
|
show 4 more comments
You sure there's only one device? It sounds like something is spamming the network with bad requests for an IP maybe...
– djsmiley2k
Dec 17 '18 at 16:37
Incomplete ARP entries will have the IP address but missing the MAC address. Which IP addresses do you see on these entries and how do they relate to the network?
– harrymc
Dec 17 '18 at 17:09
The ip address are address which are on the same subnet but not occupied by the computers
– Biruk
Dec 17 '18 at 17:30
Do you have any switches on the network? (Please add in comments the name of the person addressed, like@harrymc:)
– harrymc
Dec 17 '18 at 17:42
It sounds like something is scanning your network. It could be a user or malware.
– Ron Maupin
Dec 17 '18 at 19:02
You sure there's only one device? It sounds like something is spamming the network with bad requests for an IP maybe...
– djsmiley2k
Dec 17 '18 at 16:37
You sure there's only one device? It sounds like something is spamming the network with bad requests for an IP maybe...
– djsmiley2k
Dec 17 '18 at 16:37
Incomplete ARP entries will have the IP address but missing the MAC address. Which IP addresses do you see on these entries and how do they relate to the network?
– harrymc
Dec 17 '18 at 17:09
Incomplete ARP entries will have the IP address but missing the MAC address. Which IP addresses do you see on these entries and how do they relate to the network?
– harrymc
Dec 17 '18 at 17:09
The ip address are address which are on the same subnet but not occupied by the computers
– Biruk
Dec 17 '18 at 17:30
The ip address are address which are on the same subnet but not occupied by the computers
– Biruk
Dec 17 '18 at 17:30
Do you have any switches on the network? (Please add in comments the name of the person addressed, like
@harrymc:)– harrymc
Dec 17 '18 at 17:42
Do you have any switches on the network? (Please add in comments the name of the person addressed, like
@harrymc:)– harrymc
Dec 17 '18 at 17:42
It sounds like something is scanning your network. It could be a user or malware.
– Ron Maupin
Dec 17 '18 at 19:02
It sounds like something is scanning your network. It could be a user or malware.
– Ron Maupin
Dec 17 '18 at 19:02
|
show 4 more comments
1 Answer
1
active
oldest
votes
After inspecting the incoming traffic using Wireshark, we found that there was TCP syn packet coming from many user computers towards the gateway router using port 445, unfortunately we were using ADSL as a gateway and the ADSL couldn't stand all the load and it will start dropping packet. As a temporary solution we block the port 445 and the traffic seems fine.
answered Dec 26 '18 at 11:01
BirukBiruk
11
Towards the router itself, or through the router towards Internet hosts? The former probably means the router has "SMB file sharing" running; the latter usually means malware infection across the whole LAN.
– grawity
Dec 26 '18 at 12:04
Its the second case and Yes, the whole LAN is infected with malware.
– Biruk
Dec 27 '18 at 12:14
add a comment |
Your Answer
StackExchange.ready(function() {
var channelOptions = {
tags: "".split(" "),
id: "3"
};
initTagRenderer("".split(" "), "".split(" "), channelOptions);
StackExchange.using("externalEditor", function() {
// Have to fire editor after snippets, if snippets enabled
if (StackExchange.settings.snippets.snippetsEnabled) {
StackExchange.using("snippets", function() {
createEditor();
});
}
else {
createEditor();
}
});
function createEditor() {
StackExchange.prepareEditor({
heartbeatType: 'answer',
autoActivateHeartbeat: false,
convertImagesToLinks: true,
noModals: true,
showLowRepImageUploadWarning: true,
reputationToPostImages: 10,
bindNavPrevention: true,
postfix: "",
imageUploader: {
brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/3.0/"u003ecc by-sa 3.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
allowUrls: true
},
onDemand: true,
discardSelector: ".discard-answer"
,immediatelyShowMarkdownHelp:true
});
}
});
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fsuperuser.com%2fquestions%2f1385300%2farp-incomplete-on-the-router-connected-to-the-gateway%23new-answer', 'question_page');
}
);
Post as a guest
Required, but never shown
1 Answer
1
active
oldest
votes
1 Answer
1
active
oldest
votes
active
oldest
votes
active
oldest
votes
After inspecting the incoming traffic using Wireshark, we found that there was TCP syn packet coming from many user computers towards the gateway router using port 445, unfortunately we were using ADSL as a gateway and the ADSL couldn't stand all the load and it will start dropping packet. As a temporary solution we block the port 445 and the traffic seems fine.
answered Dec 26 '18 at 11:01
BirukBiruk
11
Towards the router itself, or through the router towards Internet hosts? The former probably means the router has "SMB file sharing" running; the latter usually means malware infection across the whole LAN.
– grawity
Dec 26 '18 at 12:04
Its the second case and Yes, the whole LAN is infected with malware.
– Biruk
Dec 27 '18 at 12:14
add a comment |
After inspecting the incoming traffic using Wireshark, we found that there was TCP syn packet coming from many user computers towards the gateway router using port 445, unfortunately we were using ADSL as a gateway and the ADSL couldn't stand all the load and it will start dropping packet. As a temporary solution we block the port 445 and the traffic seems fine.
answered Dec 26 '18 at 11:01
BirukBiruk
11
Towards the router itself, or through the router towards Internet hosts? The former probably means the router has "SMB file sharing" running; the latter usually means malware infection across the whole LAN.
– grawity
Dec 26 '18 at 12:04
Its the second case and Yes, the whole LAN is infected with malware.
– Biruk
Dec 27 '18 at 12:14
add a comment |
After inspecting the incoming traffic using Wireshark, we found that there was TCP syn packet coming from many user computers towards the gateway router using port 445, unfortunately we were using ADSL as a gateway and the ADSL couldn't stand all the load and it will start dropping packet. As a temporary solution we block the port 445 and the traffic seems fine.
answered Dec 26 '18 at 11:01
BirukBiruk
11
After inspecting the incoming traffic using Wireshark, we found that there was TCP syn packet coming from many user computers towards the gateway router using port 445, unfortunately we were using ADSL as a gateway and the ADSL couldn't stand all the load and it will start dropping packet. As a temporary solution we block the port 445 and the traffic seems fine.
answered Dec 26 '18 at 11:01
BirukBiruk
11
answered Dec 26 '18 at 11:01
BirukBiruk
11
answered Dec 26 '18 at 11:01
BirukBiruk
11
answered Dec 26 '18 at 11:01
BirukBiruk
11
11
Towards the router itself, or through the router towards Internet hosts? The former probably means the router has "SMB file sharing" running; the latter usually means malware infection across the whole LAN.
– grawity
Dec 26 '18 at 12:04
Its the second case and Yes, the whole LAN is infected with malware.
– Biruk
Dec 27 '18 at 12:14
add a comment |
Towards the router itself, or through the router towards Internet hosts? The former probably means the router has "SMB file sharing" running; the latter usually means malware infection across the whole LAN.
– grawity
Dec 26 '18 at 12:04
Its the second case and Yes, the whole LAN is infected with malware.
– Biruk
Dec 27 '18 at 12:14
Towards the router itself, or through the router towards Internet hosts? The former probably means the router has "SMB file sharing" running; the latter usually means malware infection across the whole LAN.
– grawity
Dec 26 '18 at 12:04
Towards the router itself, or through the router towards Internet hosts? The former probably means the router has "SMB file sharing" running; the latter usually means malware infection across the whole LAN.
– grawity
Dec 26 '18 at 12:04
Its the second case and Yes, the whole LAN is infected with malware.
– Biruk
Dec 27 '18 at 12:14
Its the second case and Yes, the whole LAN is infected with malware.
– Biruk
Dec 27 '18 at 12:14
add a comment |
Thanks for contributing an answer to Super User!
- Please be sure to answer the question. Provide details and share your research!
But avoid …
- Asking for help, clarification, or responding to other answers.
- Making statements based on opinion; back them up with references or personal experience.
To learn more, see our tips on writing great answers.
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fsuperuser.com%2fquestions%2f1385300%2farp-incomplete-on-the-router-connected-to-the-gateway%23new-answer', 'question_page');
}
);
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
You sure there's only one device? It sounds like something is spamming the network with bad requests for an IP maybe...
– djsmiley2k
Dec 17 '18 at 16:37
Incomplete ARP entries will have the IP address but missing the MAC address. Which IP addresses do you see on these entries and how do they relate to the network?
– harrymc
Dec 17 '18 at 17:09
The ip address are address which are on the same subnet but not occupied by the computers
– Biruk
Dec 17 '18 at 17:30
Do you have any switches on the network? (Please add in comments the name of the person addressed, like
@harrymc:)– harrymc
Dec 17 '18 at 17:42
It sounds like something is scanning your network. It could be a user or malware.
– Ron Maupin
Dec 17 '18 at 19:02