Comcast ARP Storms

Posts: 3 · New Forum Member Joined: Aug 17, 2006 Posts: 3

Comcast ARP Storms are usually caused by failing memory / aka cache in the modem. If you are getting a ton of arp traffic replace your modem...

Posts: 646 · Posted: Thu Aug 17, 2006 8:29 pm Post subject:

Sounds like BS. You'd better cite some sources.

Posts: 3 · New Forum Member Joined: Aug 17, 2006 Posts: 3

I posted this because of googling ARP Storm so I could send a link about it to a client. I found someone who blamed Vonage for it, but oddly enough they had Comcast as their ISP. I am a CCNA and have been a Network Engineer for 8 years. The only times that I have seen residential ARP Storms is because the modem is going to hell. There is also a chance that it is malware related but I just pop in Pentoo and run Ethereal, up come stats that 99% of current traffic is ARP when connected directly to the Comcast modem. I just diag'ed this for a friend in Utah yesterday and it wasn't the first time that I have seen this. The modem also reflects a hardware related problem because of a SNR fluctuation, could be multiple points of failure, like a bad line ground. If he gets a new modem and it solves the problem this will be the fourth time that I have successfully diag'ed this problem in the Comcast network. No B.S. the only reason I posted was so that Vonage wouldn't get blamed for bad Comcast modems.

Posts: 249 · Posted: Fri Aug 18, 2006 9:53 pm Post subject: Arp Storm

ARP Storm??? What in the He$$ is that? I've steamed a lot of ships through a lot of storms! None of them were called ARP.

Posts: 1123 · Vonage Forum **MVM** Joined: May 26, 2005 Posts: 1123

ARP Storm

Given the right conditions it is also possible for the lease renewal issue to cause an ARP storm. The DHCP specification states that the server may issue a "ping" packet to ensure that the offered, or requested address, is not already is use. Not all DHCP servers implement the option which can result in multiple clients attempting to use the same IP address.

If you are using the built-in DHCP server included in NT 4.x and also have a mix of Macintosh, Windows 95/98, or NT clients on the same network you may see ARP storms as a result of using DHCP. The ARP storm can last from five hundred to hundreds of thousands of packets, causing disruption of service to the two systems directly involved in the storm, as well as the potential disruption of service to all systems connected to the affected network. Other combinations of clients and servers may also exhibit this behavior.

ARP storms can and do happen, although the most prevalent use of the phenomenon is for denial-of-service attacks.

Posts: 3 · New Forum Member Joined: Aug 17, 2006 Posts: 3

When one pc is connected directly to a Comcast modem and they are experiencing connection failures or massive reductions in QoS, in all my experience it has been a bad Comcast modem. There are absolutely instances where Arp Storming could be caused by something entirely unrelated but so far not in Comcasts case. btw We are not just talking about lots of Arp packets, we are talking about 3,000 - 10,000 per 2 to 3 minutes. The last system I tested almost crashed Ethereal because it was choking on the data.