Stack Exchange Network
Stack Exchange network consists of 181 Q&A communities including
Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.
Visit Stack Exchange
Network Engineering Stack Exchange is a question and answer site for network engineers. It only takes a minute to sign up.
Sign up to join this community
Anybody can ask a question
The best answers are voted up and rise to the top
2 years, 3 months ago
This question is
. It is not currently accepting answers.
NE is a site for to ask and provide answers about professionally managed networks in a business environment. Your question falls outside the areas our community decided are on topic. Please visit the
help center for more details. If you disagree with this closure, please ask on Network Engineering Meta.
I'm trying to review a Wireshark capture and it seems the network is heavily flooded with ARP requests that make no sense to me.
The destination is not "Broadcast", but some unknown DELL device (none are present on the network).
The "who-has" IP is not part of the same network the pc is capturing from.
The "tell" IP is not part of the same network either.
Any ideas of what could be going on here?
Dec 14, 2020 at 19:26
11 1 1 bronze badge
Likely, someone has connected a rogue device to your network.
You need to look for the
source MAC address. If that is unknown, check the switch's MAC address table for the source port. Work your way back from there, across your switches, to the port of the source device. Disconnect or shut down the device.
Dec 14, 2020 at 19:46
Zac67 ♦ Zac67
78.2k 3 3 gold badges 62 62 silver badges 128 128 bronze badges
By clicking “Accept all cookies”, you agree Stack Exchange can store cookies on your device and disclose information in accordance with our
Accept all cookies
Necessary cookies only