Continuous arp requests to a specific address

Ivano

Hi everyone, I own this: Zyxel model no.: VMG8924-B10D, with FW: V5.13(ABLH.0)b6

DHCP configuration ON, no switch, cable directly connected to the router, wireshark tells me that there are continuous arp requests to an IP, I tried to turn the router off and on again but the requests continue, I tried to set a static dhcp with the requested IP and the request ended!! Once I turn off device with static IP configured the requests start again, is there a way to empty the arp table? I can't set static addresses btw.

Thanks in advance.

Hummel

@Ivano,
You said that "DHCP configuration ON, no switch, cable directly connected to the router". Does it mean you connect your PC wirelessly and capture the packets via wireshark?
It would be easy to understand your problem if you can take some screenshots of your wireshark result and also provide the topology.

Ivano

Hi, thanks for reply; I have 2 desktop in lan directly to the router, so it's like that when I power off pc2 (192.168.1.68), pc1 (192.168.1.139) try to search it (even if it's powered off), so it send an arp broadcast with that IP, and same thing does router, it try to search ip that doesn't exist anymore.
BTW I got a couple of wifi devices that connects randomly, just now I noticed that router sent a lot of arp request to a IP that doesn't exist on my lan right now, like 192.168.1.142, why it sends all those requests? Tried to reboot but nothing, take a look on attached pic.

Hummel

@Ivano,

In my opinion. you should try to find out who in the LAN of the network is trying to visit 192.168.1.142. From your description, you said when pc1(192.168.1.139) tried to search pc2(192.168.1.68) even pc2 was powered off, pc1 broadcasted arp to find it and so did the router. It makes sense to me because no one knew pc2 at that time and they both needed to send arp to find it. Eempty the arp table won't help it anymore to stop the router to broadcast the arp packets because there is someone in your network who is trying to visit that IP address.

My suggestion is try to simplify your network topology, for example, reboot the router and connect only one client in the LAN to observe if the router still keeps broadcasting arp packets. It will help you to find out the client who is trying to access an IP address which doesn't exist in your network.

Ivano

Ok I'll try thank you!

TiggerLAS

It would also be helpful if the Wireshark details weren't filtered by ARP,

particularly any items immediately preceding the ARP request.

That way, we could see if there was some other device on the network

that is trying to connect to 192.168.1.142.

If there is no other network traffic prior to these ARP requests,

then it is likely that 192.168.1.142 has been added into the

router configuration somewhere.

For example, there could be a port-forwarding rule set up

to allow traffic from the internet to reach 192.168.1.142.

It wouldn't hurt to check DHCP and DNS settings on the router itself,

just in case 192.168.1.142 was inadvertently coded in there somehow.