Is there a way of Juniper to avoid the vast ARP requests?

Question

In my Juniper router the interface always send ARP requests for some non-using IP address.

Is there any issue there?

and whether there is a way of Juniper to avoid the vast ARP requests?

Is it normal there have so many ARP requests?

---

Edit-01

and in other Juniper router, there is another issue:

....
19:21:17.207967  In arp who-has 40.21.158.134 tell 40.21.158.129              
19:21:17.207987 Out arp reply 40.21.158.134 is-at d0:07:ca:0b:63:0c            
19:21:17.891603 Out arp who-has 40.17.42.132 tell 40.17.42.134                
19:21:18.807865 Out arp who-has 40.17.42.132 tell 40.17.42.134                
19:21:21.333322 Out arp who-has 40.17.42.133 tell 40.17.42.134                
19:21:22.256325 Out arp who-has 40.17.42.133 tell 40.17.42.134                
19:21:22.974378 Out arp who-has 40.17.42.133 tell 40.17.42.134                
19:21:23.581650 Out arp who-has 40.17.42.133 tell 40.17.42.134                
19:21:24.289537 Out arp who-has 40.17.42.133 tell 40.17.42.134                
19:21:25.393399 Out arp who-has 40.17.42.133 tell 40.17.42.134                
19:21:26.198545 Out arp who-has 40.17.42.133 tell 40.17.42.134                
19:21:27.106570 Out arp who-has 40.17.42.133 tell 40.17.42.134                
19:21:27.910819 Out arp who-has 40.17.42.133 tell 40.17.42.134                
19:21:28.511469 Out arp who-has 40.17.42.133 tell 40.17.42.134                
19:21:29.713391 Out arp who-has 40.17.42.133 tell 40.17.42.134                
19:21:30.317394 Out arp who-has 40.17.42.133 tell 40.17.42.134                
19:21:31.018756 Out arp who-has 40.17.42.133 tell 40.17.42.134                
19:21:31.530481 Out arp who-has 40.17.42.133 tell 40.17.42.134                
19:21:32.137657 Out arp who-has 40.17.42.133 tell 40.17.42.134                
19:21:33.699346 Out arp who-has 40.17.42.132 tell 40.17.42.134                
19:21:34.268401 Out arp who-has 40.17.42.132 tell 40.17.42.134                
19:21:35.186173 Out arp who-has 40.17.42.132 tell 40.17.42.134                
19:21:35.796321 Out arp who-has 40.17.42.132 tell 40.17.42.134                
19:21:36.407914 Out arp who-has 40.17.42.132 tell 40.17.42.134                
19:21:38.818351 Out arp who-has 40.17.42.131 tell 40.17.42.134                
19:21:38.935274 Out arp who-has 40.17.42.132 tell 40.17.42.134                
19:21:39.460692 Out arp who-has 40.17.42.131 tell 40.17.42.134                
19:21:39.663202 Out arp who-has 40.17.42.132 tell 40.17.42.134                
19:21:40.373898 Out arp who-has 40.17.42.132 tell 40.17.42.134                
19:21:40.375047 Out arp who-has 40.17.42.131 tell 40.17.42.134                
19:21:41.084739 Out arp who-has 40.17.42.131 tell 40.17.42.134                
19:21:41.084927 Out arp who-has 40.17.42.132 tell 40.17.42.134                
19:21:41.900625 Out arp who-has 40.17.42.132 tell 40.17.42.134                
19:21:42.003071 Out arp who-has 40.17.42.131 tell 40.17.42.134                
19:21:42.671415 Out arp who-has 40.17.42.133 tell 40.17.42.134                
19:21:43.422088 Out arp who-has 40.17.42.133 tell 40.17.42.134                
19:21:44.237351 Out arp who-has 40.17.42.133 tell 40.17.42.134                
19:21:44.800125  In arp who-has 40.21.158.134 tell 40.21.158.130              
19:21:44.800143 Out arp reply 40.21.158.134 is-at d0:07:ca:0b:63:0c            
19:21:44.843554 Out arp who-has 40.17.42.133 tell 40.17.42.134                
19:21:45.453770 Out arp who-has 40.17.42.133 tell 40.17.42.134                
19:21:47.853272 Out arp who-has 40.17.42.133 tell 40.17.42.134                
19:21:48.660676 Out arp who-has 40.17.42.133 tell 40.17.42.134                
19:21:49.460576 Out arp who-has 40.17.42.133 tell 40.17.42.134                
19:21:50.160462 Out arp who-has 40.17.42.133 tell 40.17.42.134                
19:21:50.760365 Out arp who-has 40.17.42.133 tell 40.17.42.134                
19:21:55.526428 Out arp who-has 40.17.42.133 tell 40.17.42.134                
19:21:56.314292 Out arp who-has 40.17.42.133 tell 40.17.42.134                
19:21:56.925603 Out arp who-has 40.17.42.133 tell 40.17.42.134                
19:21:57.638616 Out arp who-has 40.17.42.133 tell 40.17.42.134                
19:21:57.658446  In arp who-has 40.21.158.134 tell 40.21.158.129              
19:21:57.658466 Out arp reply 40.21.158.134 is-at d0:07:ca:0b:63:0c 
....

You see the Server(40.21.158.129) ARP request at 19:21:17.207967, but it request again at 19:21:57.658446. we know the ARP record in general is 2 minutes, why there request so frequently?

Answer 1

This issue is quite common - the address 40.17.42.133 either is or has become unreachable in your network, and there are other hosts trying to connect to it via your router.

The quantity and rate of ARP requests is directly proportional to the number of requests that are destined for the destination address - note that it's not your router that is attempting the connection, but downstream hosts via your router - your router needs to resolve the MAC address of the end host though. On some lower end devices (EX virtual chassis comes to mind) this can become problematic, as it affects RE CPU as the ARP request timers are continually resynchronised between Master and Backup REs every time a new ARP goes out.

There are a number of things you could do to stop/limit this:

• a (fake) static ARP entry for 40.17.42.133 would stop the RE from continuously requesting the address, but will cause issues down the track if that address is ever used again.
• a discard route entry for 40.17.42.133 would also stop the ARP generation, but as above - will affect reachability down the track
• firewall filters to block traffic destined to this address (this would need to be applied on the ingress side)
• PCAPs on the ingress side to work out which hosts are trying to connect to the destination host, and then remediating them (not always practical at scale)