Hi,
Hopefully this isn't a silly question from a new linux hobbyist...

What is a 'normal level of broadcast/ARP activity on a subnet. I have a machine in a co-location facility and I've been trying to track down the cause of lots of martian source messages flooding my messages log file.

After much searching (I'm a relative newbie), I've managed to get wireshark to record the traffic I see on my network interface:
I average 4 ARP broacast messages per second (the filter I use is 'arp and (not (ssh or tcp))').
Most traffic comes from two servers, one I use as the gateway.
It looks as if one server 'looks' for all machines on the subnet I am on, example of the wireshark log entry:

No. Time. Source. Destination. Protocol Info.
621 21.246 Cisco_73xx Broadcast ARP Who has <my-subnet>.99 Tell <gateway-IP>

Sometimes I see 100+ of these requests in a second, but it averages out to 4/sec over half an hour.

Is this normal?

Appreciate any insights.
Cheers
pc