Excessive rate of ARP requests from Windows 7 spooler service when network printer is off

I'm having series of ARP requests broadcast by a laptop over WLAN, asking MAC address for a range of IP (192.168.0.62 --> 192.168.0.94.) The process runs for the range, stops for a 20 or 30 seconds, then repeats. The rate peaks at 10 to 20 request per second, but there are also interruptions. IP are polled almost in increasing order.

Using Windows 7 on a Lenovo W500. WLAN adapter is Intel WiFi Link 5100 AGN, driver is up to date.

Wireshark capture:

104 8.264821000 IntelCor_XX:XX:XX   Broadcast   ARP 42  Who has 192.168.0.91?  Tell 192.168.YY.YY
105 8.264856000 IntelCor_XX-XX-XX   Broadcast   ARP 42  Who has 192.168.0.92?  Tell 192.168.YY.YY
106 8.264893000 IntelCor_XX-XX-XX   Broadcast   ARP 42  Who has 192.168.0.93?  Tell 192.168.YY.YY

Since I initially posted this question, I was able to pinpoint ARP requests are sent by the Windows spooler service (C:\Windows\System32\spoolsv.exe) when the installed network printer is not on-line.

If the spooler service is stopped, ARP requests are still sent, but only for the IP of the network printer IP, and the rate is now a burst of 3 requests each 20 seconds or so.

As soon as the printer is switched on-line, the ARP flow slows further more to a request each 1 or 2 mn.

To sum up: there is an excessive rate of ARP requests to unused IP addresses on WLAN (but I guess this is not limited to wireless) sent by the print spooler as soon as the network printer is not accessible.

My question: Is there a reason for these seemingly useless requests? and a solution to stop them?

I found other users with spooler problems leading to ARP issues too, but not in the same context. I would appreciate your help.

mins

Posted 2014-07-20T18:35:32.093

Reputation: 1 009

Do you have file and printer sharing turned on? If you don't need it, turn that service off. That may be what's doing it. – Codezilla – 2014-07-21T03:24:45.817

Sharing files-printers is not on. – mins – 2014-07-26T10:06:12.290

Answers

If you have any third-party service running on your Windows machine (that tries to connect to your printer, possibly?), turn it off.

ARP requests are indeed sent out in order to receive IP addresses within the same network. This service could be checking frequently if the printer is actually up or not.

If not, access Device Manager by [WinKey]+R and typing in devmgmt.msc. Now look up the device "YourPrinter" and check if there are any options available to turn off Auto-Discovery or such.

Rowan Kaag

Posted 2014-07-20T18:35:32.093

Reputation: 96

'Configuration Panel'? – AStopher – 2014-07-21T07:34:02.033

Thanks. The printer is a combo fax-scanner-printer Canon MX-880. There is a possibility to scan from the printer panel and send the result to a computer. The computer listens for such input. Deselecting this option using "IJ Network Scanner Selector EX" (CNMNSST.exe) stops the ARP requests for bulk IPs but the one of the printer. – mins – 2014-07-26T09:48:56.490

@zyboxenterprises Isn't that what it's called in Windows? :$ – Rowan Kaag – 2014-07-31T13:02:11.773

@mins So did it solve the problem for you? – Rowan Kaag – 2014-07-31T13:02:27.450

@RowanKaag It's called Control Panel. Anyways, that's not the correct method of accessing device manager.. – AStopher – 2014-07-31T13:20:33.077

1@zyboxenterprises ah thanks, I've been a mac user for a while now, plus I'm Dutch. Forgot about the English names used for some items within Windows. I know there are multiple ways to access device manager, but this is the most straight forward and easy to understand I suppose. – Rowan Kaag – 2014-07-31T13:24:42.020

@RowanKaag I submitted a Suggested Edit with the correct term, and correct way of accessing Device Manager. – AStopher – 2014-07-31T13:26:28.943

@RowanKaag: it did, the way detailed in my first comment. Note that you will have to do the change for all hosts that have the feature installed, since each host sends its burst or ARP requests. – mins – 2014-08-01T11:59:46.153