2
1
I'm having series of ARP requests broadcast by a laptop over WLAN, asking MAC address for a range of IP (192.168.0.62 --> 192.168.0.94.) The process runs for the range, stops for a 20 or 30 seconds, then repeats. The rate peaks at 10 to 20 request per second, but there are also interruptions. IP are polled almost in increasing order.
Using Windows 7 on a Lenovo W500. WLAN adapter is Intel WiFi Link 5100 AGN, driver is up to date.
Wireshark capture:
104 8.264821000 IntelCor_XX:XX:XX Broadcast ARP 42 Who has 192.168.0.91? Tell 192.168.YY.YY
105 8.264856000 IntelCor_XX-XX-XX Broadcast ARP 42 Who has 192.168.0.92? Tell 192.168.YY.YY
106 8.264893000 IntelCor_XX-XX-XX Broadcast ARP 42 Who has 192.168.0.93? Tell 192.168.YY.YY
Since I initially posted this question, I was able to pinpoint ARP requests are sent by the Windows spooler service (C:\Windows\System32\spoolsv.exe
) when the installed network printer is not on-line.
If the spooler service is stopped, ARP requests are still sent, but only for the IP of the network printer IP, and the rate is now a burst of 3 requests each 20 seconds or so.
As soon as the printer is switched on-line, the ARP flow slows further more to a request each 1 or 2 mn.
To sum up: there is an excessive rate of ARP requests to unused IP addresses on WLAN (but I guess this is not limited to wireless) sent by the print spooler as soon as the network printer is not accessible.
My question: Is there a reason for these seemingly useless requests? and a solution to stop them?
I found other users with spooler problems leading to ARP issues too, but not in the same context. I would appreciate your help.
Do you have file and printer sharing turned on? If you don't need it, turn that service off. That may be what's doing it. – Codezilla – 2014-07-21T03:24:45.817
Sharing files-printers is not on. – mins – 2014-07-26T10:06:12.290