我们有一台Windows 2003r2服务器，它向多个不在networking上的设备发送间歇性的ARP请求。 这样做的结果是中断运行在modbus上的PLC。
服务器在我们的networking上运行DHCP，打印服务和文件共享，我们还没有尝试closures它。 它在一个专用的IBM服务器上运行，并在NIC上组合。
最坏的情况是，服务器会在1毫秒的时间内向同一组设备发送大约4个“谁请求”，其中PLC是其中之一 – 这在networking上很奇怪 – 也许是这样不支持ARP？
No. Time Source Destination Protocol Length Info 1522 11:49:26.578133000 Ibm_28:2d:e6 Broadcast ARP 60 Who has 192.168.6.245? Tell 192.168.6.227 (duplicate use of 192.168.6.227 detected!) Frame 1522: 60 bytes on wire (480 bits), 60 bytes captured (480 bits) on interface 0 Ethernet II, Src: Ibm_28:2d:e6 (00:14:5e:28:2d:e6), Dst: Broadcast (ff:ff:ff:ff:ff:ff) [Duplicate IP address detected for 192.168.6.227 (00:14:5e:28:2d:e6) - also in use by 00:14:5e:28:2d:e7 (frame 1437)] Address Resolution Protocol (request) No. Time Source Destination Protocol Length Info 1523 11:49:26.578137000 Ibm_28:2d:e6 MoxaTech_2d:ec:26 ARP 60 Who has 192.168.6.193? Tell 192.168.6.227 (duplicate use of 192.168.6.227 detected!) Frame 1523: 60 bytes on wire (480 bits), 60 bytes captured (480 bits) on interface 0 Ethernet II, Src: Ibm_28:2d:e6 (00:14:5e:28:2d:e6), Dst: MoxaTech_2d:ec:26 (00:90:e8:2d:ec:26) [Duplicate IP address detected for 192.168.6.227 (00:14:5e:28:2d:e6) - also in use by 00:14:5e:28:2d:e7 (frame 1437)] Address Resolution Protocol (request) No. Time Source Destination Protocol Length Info 1524 11:49:26.578139000 Ibm_28:2d:e6 192.168.6.73 ARP 60 Who has 192.168.6.73? Tell 192.168.6.227 (duplicate use of 192.168.6.227 detected!) Frame 1524: 60 bytes on wire (480 bits), 60 bytes captured (480 bits) on interface 0 Ethernet II, Src: Ibm_28:2d:e6 (00:14:5e:28:2d:e6), Dst: 192.168.6.73 (00:15:b7:44:58:52) [Duplicate IP address detected for 192.168.6.227 (00:14:5e:28:2d:e6) - also in use by 00:14:5e:28:2d:e7 (frame 1437)] Address Resolution Protocol (request) No. Time Source Destination Protocol Length Info 1525 11:49:26.578148000 192.168.6.73 Ibm_28:2d:e6 ARP 42 192.168.6.73 is at 00:15:b7:44:58:52 (duplicate use of 192.168.6.227 detected!) Frame 1525: 42 bytes on wire (336 bits), 42 bytes captured (336 bits) on interface 0 Ethernet II, Src: 192.168.6.73 (00:15:b7:44:58:52), Dst: Ibm_28:2d:e6 (00:14:5e:28:2d:e6) [Duplicate IP address detected for 192.168.6.227 (00:14:5e:28:2d:e6) - also in use by 00:14:5e:28:2d:e7 (frame 1437)] Address Resolution Protocol (reply) No. Time Source Destination Protocol Length Info 1526 11:49:26.578723000 Ibm_28:2d:e6 Inventec_88:ea:a4 ARP 60 Who has 192.168.6.38? Tell 192.168.6.227 (duplicate use of 192.168.6.227 detected!) Frame 1526: 60 bytes on wire (480 bits), 60 bytes captured (480 bits) on interface 0 Ethernet II, Src: Ibm_28:2d:e6 (00:14:5e:28:2d:e6), Dst: Inventec_88:ea:a4 (00:26:6c:88:ea:a4) [Duplicate IP address detected for 192.168.6.227 (00:14:5e:28:2d:e6) - also in use by 00:14:5e:28:2d:e7 (frame 1437)] Address Resolution Protocol (request) No. Time Source Destination Protocol Length Info 1527 11:49:26.578725000 Ibm_28:2d:e6 Hewlett-_dc:a8:b2 ARP 60 Who has 192.168.6.200? Tell 192.168.6.227 Frame 1527: 60 bytes on wire (480 bits), 60 bytes captured (480 bits) on interface 0 Ethernet II, Src: Ibm_28:2d:e6 (00:14:5e:28:2d:e6), Dst: Hewlett-_dc:a8:b2 (b4:99:ba:dc:a8:b2) Address Resolution Protocol (request) No. Time Source Destination Protocol Length Info 1528 11:49:26.578727000 Ibm_28:2d:e6 192.168.6.56 ARP 60 Who has 192.168.6.56? Tell 192.168.6.227 (duplicate use of 192.168.6.227 detected!) Frame 1528: 60 bytes on wire (480 bits), 60 bytes captured (480 bits) on interface 0 Ethernet II, Src: Ibm_28:2d:e6 (00:14:5e:28:2d:e6), Dst: 192.168.6.56 (00:00:54:10:77:b5) [Duplicate IP address detected for 192.168.6.227 (00:14:5e:28:2d:e6) - also in use by 00:14:5e:28:2d:e7 (frame 1527)] Address Resolution Protocol (request) No. Time Source Destination Protocol Length Info 1529 11:49:26.578729000 Ibm_28:2d:e6 Fuji-Xer_2a:7f:c6 ARP 60 Who has 192.168.6.245? Tell 192.168.6.227 (duplicate use of 192.168.6.227 detected!) Frame 1529: 60 bytes on wire (480 bits), 60 bytes captured (480 bits) on interface 0 Ethernet II, Src: Ibm_28:2d:e6 (00:14:5e:28:2d:e6), Dst: Fuji-Xer_2a:7f:c6 (08:00:37:2a:7f:c6) [Duplicate IP address detected for 192.168.6.227 (00:14:5e:28:2d:e6) - also in use by 00:14:5e:28:2d:e7 (frame 1527)] Address Resolution Protocol (request) 包括一个来自Wireshark的捕获，它监视交换机上的PLC端口。 上述输出又一次重复5次。 这又会杀死modbus输出。
它似乎发生在半定期的基础上 – 它会像上面那样吐出大约40帧（4或5次迭代），然后3秒钟后，它只会吐出一次（一次迭代）。
我有：重新启动打印服务; 刷新ARPcaching; 并确保这些主机挑衅不存在。
任何帮助将不胜感激！！
编辑：附图：
Wireshark捕获
如果您的PLC由于某些stream浪ARP数据包而失败，那么我认为您可以很好地隔离PLCnetworking！ 这不是一个过多的stream量，除非有一个MAC或IP地址冲突与PLC我真的不知道如何/为什么PLC应该失败。
看起来，如果我正在阅读这个权利，组合的NIC都回答相同的IP。 我不认为这是你的问题，但我确实想把它叫做一个可能的红鲱鱼。
尝试与这些现在断开连接的设备进行通信的计算机上可能有一些服务。 如果你想find这个服务，你可能会有这样的好运，通过为这些ARP请求做出回应，然后看看服务器试图用什么协议来与目的地进行通信。
我想知道是否可能会发现一些Broadcom驱动程序和ARP泛滥的问题 ，尽pipe您的数据包数量不足以成为论坛中描述的问题。