Excessive ARP broadcasts

[mlsommer]

Does anyone know why my 6509 will occasionally query an entire subnet with ARP requests? It's pretty infrequent (maybe once an hour or once ever 2 hours) but when the router sends out a massive broadcast (2 ARP requests per IP for the entire class C subnet within 1 or 2 seconds) it's causing interruptions/drops in h.323 streams. Any ideas why or how I could limit this kind of broadcast so it will not affect h.323 streams and other traffic?

Thanks for the help!

-Matt

[t.baranski]

One reason that occurs to me offhand is if the 6509 receives a packet destined for the subnet's broadcast address, and doesn't have 'no ip directed-broadcast' configured on the subnet's interface. I believe it will try to send this packet to every IP in the subnet in this case.

[Tsasbrink]

Probably someone who is using a scanning tool, we know this kind of behaviour to occur when using HP webjet admin and a Visio pluging witch is to discover your network. We used a sniffer on our switched backbone to catch the snmp gets adressed to the switches.