Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I'm having series of ARP requests broadcast by a laptop over WLAN, asking MAC address for a range of IP (192.168.0.62 --> 192.168.0.94.) The process runs for the range, stops for a 20 or 30 seconds, then repeats. The rate peaks at 10 to 20 request per second, but there are also interruptions. IP are polled almost in increasing order.

Using Windows 7 on a Lenovo W500. WLAN adapter is Intel WiFi Link 5100 AGN, driver is up to date.

Wireshark capture:

104 8.264821000 IntelCor_XX:XX:XX   Broadcast   ARP 42  Who has 192.168.0.91?  Tell 192.168.YY.YY
105 8.264856000 IntelCor_XX-XX-XX   Broadcast   ARP 42  Who has 192.168.0.92?  Tell 192.168.YY.YY
106 8.264893000 IntelCor_XX-XX-XX   Broadcast   ARP 42  Who has 192.168.0.93?  Tell 192.168.YY.YY

Since I initially posted this question, I was able to pinpoint ARP requests are sent by the Windows spooler service (C:\Windows\System32\spoolsv.exe) when the installed network printer is not on-line.

If the spooler service is stopped, ARP requests are still sent, but only for the IP of the network printer IP, and the rate is now a burst of 3 requests each 20 seconds or so.

As soon as the printer is switched on-line, the ARP flow slows further more to a request each 1 or 2 mn.

To sum up: there is an excessive rate of ARP requests to unused IP addresses on WLAN (but I guess this is not limited to wireless) sent by the print spooler as soon as the network printer is not accessible.

My question: Is there a reason for these seemingly useless requests? and a solution to stop them?

I found other users with spooler problems leading to ARP issues too, but not in the same context. I would appreciate your help.

share|improve this question
    
Do you have file and printer sharing turned on? If you don't need it, turn that service off. That may be what's doing it. –  Codezilla Jul 21 at 3:24
    
Sharing files-printers is not on. –  mins Jul 26 at 10:06

1 Answer 1

up vote 1 down vote accepted

If you have any third-party service running on your Windows machine (that tries to connect to your printer, possibly?), turn it off.

ARP requests are indeed sent out in order to receive IP addresses within the same network. This service could be checking frequently if the printer is actually up or not.

If not, access Device Manager by [WinKey]+R and typing in devmgmt.msc. Now look up the device "YourPrinter" and check if there are any options available to turn off Auto-Discovery or such.

share|improve this answer
    
'Configuration Panel'? –  zyboxenterprises Jul 21 at 7:34
    
Thanks. The printer is a combo fax-scanner-printer Canon MX-880. There is a possibility to scan from the printer panel and send the result to a computer. The computer listens for such input. Deselecting this option using "IJ Network Scanner Selector EX" (CNMNSST.exe) stops the ARP requests for bulk IPs but the one of the printer. –  mins Jul 26 at 9:48
    
@zyboxenterprises Isn't that what it's called in Windows? :$ –  Rowan Kaag Jul 31 at 13:02
    
@mins So did it solve the problem for you? –  Rowan Kaag Jul 31 at 13:02
1  
@zyboxenterprises ah thanks, I've been a mac user for a while now, plus I'm Dutch. Forgot about the English names used for some items within Windows. I know there are multiple ways to access device manager, but this is the most straight forward and easy to understand I suppose. –  Rowan Kaag Jul 31 at 13:24

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.