What is 'normal' broadcast/ARP activity
Hopefully this isn't a silly question from a new linux hobbyist...
What is a 'normal level of broadcast/ARP activity on a subnet. I have a machine in a co-location facility and I've been trying to track down the cause of lots of martian source messages flooding my messages log file.
After much searching (I'm a relative newbie), I've managed to get wireshark to record the traffic I see on my network interface:
I average 4 ARP broacast messages per second (the filter I use is 'arp and (not (ssh or tcp))').
Most traffic comes from two servers, one I use as the gateway.
It looks as if one server 'looks' for all machines on the subnet I am on, example of the wireshark log entry:
No. Time. Source. Destination. Protocol Info.
621 21.246 Cisco_73:xx:xx Broadcast ARP Who has <my-subnet>.99 Tell <gateway-IP>
Sometimes I see 100+ of these requests in a second, but it averages out to 4/sec over half an hour.
Is this normal?
Appreciate any insights.