BBox flooding network with ARP requests

[mkhopper]

Anyone have any idea why the BBox is blasting my network with constant ARP requests?

I started wondering why my router lights would suddenly start all going off at once and began doing some network digging. Didn't take long to find what was going on.

Every so often the BBox, even while in sleep-mode, will hammer my internal lan with requests for address of my entire net block.

My lan is setup to only use x.x.x.100-110, yet the Bbox sends out a flurry of activity every 5 minutes or so requesting information for x.x.x.1-254.

They're small packets, so it's not like they get in the way or anything, but I'd just like to know the reason why it's doing that and if I can turn it off.

If I have to, I'll just configure my firewall to drop these packets as they're generated, but I'd rather have a way to stop the BBox from making the requests at all.


Sample output from a tcpdump. (x.x.x.102 is the BBox)

tcpdump -i eth0 -l -n arp

20:11:43.899064 ARP, Request who-has x.x.x.181 tell x.x.x.102, length 46
20:11:44.027131 ARP, Request who-has x.x.x.172 tell x.x.x.102, length 46
20:11:44.067083 ARP, Request who-has x.x.x.177 tell x.x.x.102, length 46
20:11:44.107095 ARP, Request who-has x.x.x.182 tell x.x.x.102, length 46
20:11:44.235095 ARP, Request who-has x.x.x.173 tell x.x.x.102, length 46
20:11:44.275116 ARP, Request who-has x.x.x.178 tell x.x.x.102, length 46
20:11:44.315140 ARP, Request who-has x.x.x.183 tell x.x.x.102, length 46
20:11:44.443112 ARP, Request who-has x.x.x.174 tell x.x.x.102, length 46
20:11:44.483114 ARP, Request who-has x.x.x.179 tell x.x.x.102, length 46
20:11:44.523130 ARP, Request who-has x.x.x.184 tell x.x.x.102, length 46
20:11:44.651131 ARP, Request who-has x.x.x.175 tell x.x.x.102, length 46

[Alcaron]

I wonder personally if this sort of bad behavior is responsible for the occassional apparent pronging that causes my PC to lose its connection until I reset the adapter.

It is SUPER aggravating and one of the most important bugs since the day it came out, yet I don't think they have ever even acknowledged it is a problem.

[darcilicious]

Has anyone reported this to their very open and very public issue tracker? http://jira.boxee.tv -- register and submit it as an issue so they can look into it.

[xxbeanxx]

My guess is it is looking for clients on the subnet so it can discover shares. Why would you waste time filtering them, they're only arp requests and will do no harm to your network. There are tons of devices and software that use this method to scan for hosts. It shouldn't be considered a bug.

Also if you want your lan to use only 100-110, set up your subnet mask accordingly. That the box is scanning 0-254 suggests that your lan is actually set up to use those IPs, not the ones you suggested. The closest you're gonna get to the network you specify is to use a subnet mask of 255.255.255.240 which will allow you x.x.x.97 to x.x.x.110.

To mkhopper: your connection on your PC shouldn't drop because it receives a few arp requests every 5 minutes. I routinely arp flood my hosts (thousands a second for minutes at a time) and have never experienced a disconnect.

[props000]

http://jira.boxee.tv/browse/BOXEE-7260

Could these issues be related? I'm not technical enough to know. I can't leave my BB on overnight because of it.

[gregwa]

it is very possible. However, it seems that the Boxee team seems to think that the amount of requests are not an issue.

I also see this. My network seems to slow a bit when this happens.

[petron]

Interesting. I wonder if this relates to the issue I've described here

[mkhopper]

@xxbeanxx, you're correct, my subnet mask is not configured to use only .100-.110. I misspoke when I mentioned that I'm configured only for that range. (That range is just what I configured for wifi devices only....)

And yes, my first thought was that the box was just scanning the network for new device shares. As I mentioned, they are just simple arp requests and I see no network slowdown at all during the flurry of activity.

I was just curious if share discovery is what it really is doing and if there was a way to disable it if possible.

[darcilicious]

and if there was a way to disable it if possible.

There isn't a setting to control this, no.

[mph]

I think it's related to this issue http://jira.boxee.tv/browse/BOXEE-7464 about boxee preventing Win7 PCs from entering S3 sleep.

A comment from Dan Conti:
Heya,

Yes, the box has a constant background scanner, independent of searching for content, that is sending out netbios traffic. The netbios traffic it sends is designed to see if a given host is still available so we can add/remove machines we show in the file menu.