I need help understanding an ARP Storm PCAP I'm currently studying. My understating is that routers will strip layer 2 info. Therefore, an ARP request frame will not go through a layer 3 device (Broadcast Domain). However, in the storm PCAP I see ARP requests from 8 different networks. Assuming that the computer running Wireshark has an IP address from one of those networks, it does not explain how the other IPs are sending ARP requests.
One solution that someone mentioned is that: The ARP request are NOT coming from external networks. Instead, the ARP requests are coming from workstations on the network trying to reach external websites so they'll send a broadcast out to the entire network looking for the MAC. They attempt to resolve public IP addresses, but it never occurs in this instance.
However, if this is the case, how come when I run Wireshark on my laptop and visit websites I never visited before, I do not see an ARP request? Or from any of my other devices doing the same thing (i.e. visiting websites never visited before). Is there a way to recreate this in a smaller scale?
Thank you in advance!