Need help with network issue - ARP Broadcasts

[LF1949]

Hi, I’m looking for a little network help. On the morning of Thursday April 21 before turning on my computer, I noticed the activity light on my Motorola SB5100 modem and the WAN (Internet) light on my Asus router flashing constantly. Checking the Traffic Monitor on the router I could see a 3-5 KB/s of incoming traffic none of which was making it to my computer. This has been happening 24/7 since Thursday.

I called Rogers and was told the flashing was normal but my modem (which I own) was very old and it had likely failed. I have a friend on the other side of town with a similar modem, so I asked him to check his and it is doing the same thing.

This morning I removed the router and connected my computer directly to the modem. When the computer was boot the modem flashing started again. I ran Wireshark and did a quick capture which showed I was getting 40-50 ARP requests per second.

They are all similar to this, each one with different seemingly random IPs:

Source                 Dest           Prot   Size  Info

Casa_91:68:1F  Broadcast  ARP   60     Who has 24.166.173.159? Tell 24.166.172.1

I’m wondering if it has anything to do with Roger’s implementation of IPv6. Maybe trying to assign an IPv6 IP to an IPv4 only device.

Any help would be appreciated.

***Edited Labels***

[Gdkitty]

I beleive it has to deal with, the topic of this thread its been moved to.

The constant blinking is it repsonding to the CMTS ARP responses.  

But there should be no data used, etc.

[Bob7]

Modem PC/Activity light continually blinking

Until a few days ago the PC/Activity light on my Motorola Surfboard cable modem only blinked when I was uploading or downloading info from the net.  Now it is blinking continually, and the router is password protected.   I have a GB usage limit to worry about.  Anyone know why this is happening, and if it's a problem?  Thx.

[RogersCilio]

Hello @Bob7,

I also had the Motorola SB 5101 for a good 10+ years before I had to swap it out, due to a plan upgrade.  From my experience, that's never been a fault or an issue, it's built like a rock and probably my favorite modem to this day.

It could be the router generating traffic, albeit very little.  Have you tried connecting your PC directly to the modem, by passing your router and seeing if it still behaves the same?

Does this happen even with your PC/devices powered off?

It really shouldn't be a problem, as I said, personally I have never experienced anything like that.

Anyone else in the Community come across this before?

Cheers,

RogersCilio

[Datalink]

Nope that not it.  Its a continuous broadcast of ARP messages from the CMTS after the CMTS has been switched from a Cisco CMTS to a Casa Systems CMTS.  This has been noticed by several people.

[Bob7]

Thx Data.  The blinking doesn't eat up usage, with it blinking all day and hardly any surfing being done, the usage for the day was a third of a gig.  (BTW, it still blinks with the PC off).  I wanted to ask, when I use a program to hide my IP address so I can surf anonymously, are there any implications for Casa Systems CMTS?

[Gdkitty]

Datalink beat me to it 🙂  Was going to say the CASA CMTS

Any form of VPN, etc, no shouldnt effect anything in that way.  The CMTS is talking to the router at a low level, really to just register that its there, etc.
Anything done on the internet, is dont on a higher layer.. pretty much your just encrypting your session, but is no different than normal.

[Datalink]

@Bob7, here's a link to a DSLreports thread on the same issue.  You can see the ARP broadcasts further down the thread.

https://www.dslreports.com/forum/r30725833-Cable-ARP-storm-since-1am-KW-burp-overnight

[Dugi]

@RogersMoin wrote:

Edited Post : Update

The visible ARP broadcasts are due to our network migrating from "Cisco CMTS" to "Casa CMTS". The broadcasts have zero operational impact on the modems. In technical terms, when traffic comes from the Internet destined to a particular modem, we need to find the MAC address for that modem. In Cisco world, the CMTS would ask the DHCP server first for that information. In casa world, the modem's IP is checked first before querying the DHCP server. So these ARP requests would be expected behaviour with the Casa systems.

As for the Internet data usage, the traffic which originates or terminates to a specific MAC address is counted as Internet usage. In the case of these ARP requests, the traffic does not originate or is not destined to a customer modem and therefore does not count towards Internet usage.

Thanks,

RogersMoin

It seems to me that this issue has already been solved by RogersMoin a number of months ago. Did no one go back and read his reply? This issue has just started for me, the visible ARP broadcasts, and it certainly seems to me like his response is the best one on these forums!

[PaulH]

I noticed an increase in traffic on my LAN and narrowed it down the the Rogers Modem (I have the older CGN2).  A bit of work with Wireshark revealed it was the same ARP issue described in this thread, but in my case it was about 100-130 ARP requests per second.  Now that I know what it is, I can ignore it.  But it is a bit odd this traffic appeared when it did - and I wonder how long it will stay?

[JKnott]

I'm a bit late to the thread, but I also see a lot of ARPs.  Yesterday, I saw 6672 in about a minute.  That seems excessive to me, even if the CMTS isn't talking to the DHCP server.  Normally, an ARP request is sent out only if there's traffic for an IP address and the MAC isn't known.  Once it's learned through ARP, it's not necessary to do it again, unless the traffic stops long enough for the ARP cache entry to time out.  So, a steady 6K+ per minute makes me think there's something wrong, as that level of ARP requests is simply not normal.

[JKnott]

In comparison, I monitored for ARP requests to my IPv4 address for about 2 hours.  In that time, I saw only one.  This is how ARP is supposed to work.  A request is made only when there is traffic for that IP and the MAC isn't known.  Once it is, there is no need to ask again, unless the ARP cache times out.  In my case, there is enough traffic to keep it from timing out most of the time.

[supahphly]

I'm not sure I'd call this 'solved' as the issue is still there, we just know what it is now.  I'm not sure when it started happenng for me but yesterday using wireshark I captured over 11,000 arp requests in 60 seconds.  It's nice to hear that it's not counted towards data usage, and that it doesn't impact the modem, but all of those requests are being received on my router or PC (or whatever I have attached to the modem) and need to be processed to determine if they can be ignored.

Is there any way to filter this?  A few here and there is no problem, but 11,000 per minute is excessive.

[Datalink]

Those ARP Requests that you can see now are the result of the switch over from the Cisco CMTS to the Casa Systems CMTS throughout last year.  For whatever reason, those ARP Requests are no longer filtered by the CMTS as they once were.  Maybe @RogersDave could comment on any future plans for filtering these. 

[RogersDave]

Unfortunately no there are no plan for that.

The below is a more technical explanation....

In a DOCSIS network, and to prevent IP spoofing, there is a check against the DHCP server (lease verify) to ensure that a modem is not using a spoofed IP. If a packet arrives at the CMTS and the CMTS doesn't have an entry mapping the MAC address with the IP, it will check against the DHCP to update this information.

In the Cisco world, the check was performed right away on the DHCP for any packet arriving to the CMTS with an unmapped entry. This is a slow and costly operation. In the CASA world, the CMTS will first perform an ARP request to ensure that there is a modem claiming this IP and then will perform the DHCP lease verify request.

This also explains why the "Activity" light on modems is now blinking constantly but ultimately, it has no performance impact as it accounts for a very very small percentage of traffic on the entire MAC domain.

Dave

[JKnott]

Normally, the arp cache retains MAC addresses for a period of time, to aleviate the need for an ARP request every time the MAC address is needed.  Someone mentioned 11,000 ARP requests in a minute.  That seems to be quite a lot, if an ARP cache is used.

[lupinglade]

This is not normal. Rogers/casa need to get this ARP storm issue corrected. It is bogging down hardware.