FreeBSD Router : ARP who-has requests

[gnn at FreeBSD.org]

At Mon, 20 Dec 2004 19:28:21 +0000,
Lee Johnston wrote:
> Does any one have any ideas on this? Could the kernel option (options HZ) 
> which we use for dummynet/polling effect the rate in which ARP requests are 
> issued?
> 
> I had planned to place each subnet in a VLAN, and looks like this will have 
> to be done fairly quickly. But I just don't understand the sudden increase. 
> My only other though is that some could be port scanning, or someone has 
> just been exploited.
> 
> Appreciate any feedback.
> 

This may be obvious to you, but I would sniff the net for the IPs that
are being arped for.  Also, if you're being scanned there might be a
pattern.

Good luck,
George