1
%Apr 30 11:32:06:216 2000 ICT ARP/4/RATELIMIT: The ARP packet rate(178pps) exceeded the rate limit(50pps) on interface GigabitEthernet1/0/24 in the last 60 seconds.
%Apr 30 11:33:06:824 2000 ICT ARP/4/RATELIMIT: The ARP packet rate(170pps) exceeded the rate limit(50pps) on interface GigabitEthernet1/0/24 in the last 60 seconds.

What could be the cause?

  • 1
    Something is generating lots of ARP packets. You'll need a sniffer to see who. The most likely cause is a host with a misconfigured address. – Ron Trunk Feb 14 '17 at 13:42
  • Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you could provide and accept your own answer. – Ron Maupin Aug 16 '17 at 22:55
2

Possibilities I see:

  1. An ARP scan is being done by the host either in an NMAP capacity (NMAP is used to create a 'picture' so to speak of your network. This could be done for malicious reasons.)

  2. For something non-malicious such as printer/other device discovery as in the following article: https://blogs.technet.microsoft.com/nettracer/2010/08/05/excessive-arp-requests-is-it-malware-or-legitimate-activity/

  3. You may have assymetric routing, as in the case of this example: http://iosadchuk.blogspot.com/2012/08/dependence-between-arp-max-age-time-and.html which results in a unicast flood.

HP Comware is showing the ARP rate is exceeded because one of these options may send out ARP requests at an extreme rate (in your case 178 packets per second) while your switchport is set to allow a maximum of 50 pps.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.