Windows XP Home issuing about 20 ARP requests a second

Question

I have been asked to remotely fix a family member's computer that is running "slow". I've had them run any number of S&D and AVG scans, even in safe mode, but they find nothing of interest. In using Remote Assistance to poke around, I installed Wireshark and discovered that the box is issuing up to 20 ARP requests per second, mostly for its local subnet (directly connected to WebSTAR 2000 USB cable modem) as seen in the graphic below.

The IP address at the time was 70.119.184.xx/255.255.240.0. The default gateway was 70.119.176.1 and the DHCP server was 10.212.0.1.

Is it possible this is legitimate traffic, or is this a symptom of a worm like WootBot trying to spread?

EDIT: I think the machine is infected with Trojan.Opachki or something very like it.

EDIT: The ARP traffic is actually sourced elsewhere so it is not an issue with the machine in question. There was signs of an Opachki infection but I think that has been cleared up. I'll put him down for a router next Christmas.

Answer 1

Not to be a party pooper, but the size of the subnet is irrelevant to the number of ARP broadcasts per second. Just because a subnet is large enough for x number of hosts doesn't mean that a host will ARP for x number of ip addresses in that subnet. A host sends an ARP packet when it needs to send a packet to another host. The only time a host will ARP for x number of ip addresses in it's subnet (or a large number of ip addresses in it's subnet) is if it's scanning the ip address range for it's subnet (using an IP scanning program), it's infected with malware, or has a faulty NIC or NIC driver. At no other time does a host normally send a large number of ARP packets like what you're seeing. Additionally a host will not send an ARP packet for an ip address that's not on it's local subnet as it knows that the ip address is not local and that it needs to send it to it's default gateway, and therefore will not send an ARP packet for that ip address.

You have 5 hosts sending ARP packets on the network:

10.212.0.1 - This seems normal. This is the default gateway and there's only one ARP packet in your screenshot. The default gateway will send ARP packets in to the network when it needs to pass traffic to an internal host and that hosts' MAC address is not in it's ARP cache (like every other network device does).

24.170.135.1 - I don't understand this one. This is a non-local ip address. Where is it coming from? Do you have multiple networks bridged together? Do any of the computers have multiple NIC's connected to multiple networks or multiple connections, such as a VPN connection, etc.

24.233.137.1 - Again, this is a non-local ip adress.

70.119.248.1 - This is probably normal, although the ip addresses it's ARP'ing for seem a little out of place. They're in the same subnet but far separated from what I would consider a normal ip addressing scheme.

70.119.176.1 - This is the one that worries me as it's the one sending the bulk of the ARP packets. I suspect that this one is either performing a subnet scan for all ip adresses in the subnet, it's infected with malware, or it has a bad NIC or NIC driver.

ARP floods (which is what I believe you're dealing with) are not a normal condition in a network. ARP broadcasts exceeding about 3 -5 % of all network traffic is a very good indication that something is wrong.

EDIT

After re-reading your question with your recent edits, I have a different opinion of what's going on: if 70.119.176.1 is the default gateway for the network, and it's the one sending the bulk of the ARP requests for addresses in the subnet, then I'm thinking that someone external to you is performing an ip address\port scan against your network and your firewall is not blocking it. For every ip address being probed, your default gateway is sending an ARP request to try and find a host on the ip address being probed. Does your firewall, router, or modem have a log that you can look at?

I still don't understand where the 24.x.x.x addresses are coming from.

Answer 2

Well with the computer directly connected to the cable modem you're going to get a lot of background noise. Especially on a broadcast domain that's a /20 which can support around 4.1k hosts. I'm not familiar with this modem, is USB the only option to hook this up to a local host/network?

I always recommend that you put a router in between your network and a broadband connection. Even if the network consists of a single computer. NAT will drop any unsolicited traffic which will effectively work as a firewall keeping worms from being able to gain direct access to a computer. This is especially important when you're talking about a Windows PC.

Answer 3

20 ARP Per second is certainly in the range of normal background noise for the /20 subnet. I am suprised it is not higher. In general ARP requests are not by themself a sign of a worm trying to spread. You know just enough to be dangerouse but not enought yet to know how to look at network traffic. Keep at it and keep asking questions you will gain the insight to make real use of your tool kit.