0

I just discovered an anomaly on my network that has presumably been going for some time. My wife's laptop (192.168.1.116 alias Sarahs-ROG.local) is sending ARPs for huge blocks of IPs to broadcast asking for 192.168.1.103 through 192.168.1.135. (My DHCP pool starts at 192.168.1.100 and goes to 149. Coincidence?)

This traffic is recorded from my PC (192.168.1.122) on another switchport. Discovery Lunacy

I attempted to resolve it by disabling a number of her Windows 10 networking things (Discovery, Homegroup, File sharing, and possibly more), but nothing stopped the flood of ARPs and LLMNRs.

What is causing this?

EDIT: The plot thickens! It stops the ARP broadcasts to that ipv4 range mentioned above when I turn my Canon printer on. It continues the merciless LLMNR assaults, though.

Improve this question
5
  • Arp requests are expected if you have devices on those addresses. Are they? The LLMNR requets look like you have "automatically detect proxy" in the browser.
    – Paul
    Nov 25, 2015 at 23:30
  • @Paul Only a few devices, and only about 10 at any given time. This block repeats constantly, not just once. Also, added a note about the printer.
    – Tim G
    Nov 25, 2015 at 23:39
  • Ok, so it looks like the Canon print driver on the laptop is looking for a printer, and it stops when it finds one.
    – Paul
    Nov 25, 2015 at 23:41
  • @Paul Ok, seeing you say the auto-proxy thing helps, I see now that's what it's doing. I turned it off in Windows' settings and it continued, but killing Chrome seems to have done it. Any idea about how to curb this printer driver's abusive networking?
    – Tim G
    Nov 25, 2015 at 23:44
  • IJ Network Scanner Selector EX was the application to solve it. I opened the Scan from Operations panel and unchecked the printer. Much better, now. @Paul, you've got my thanks on the answer here; go ahead and note it so I can accept it, unless there's a way to select a comment as a best answer.
    – Tim G
    Nov 26, 2015 at 0:03

1 Answer 1

Reset to default
4

The "wpad" at the end of the LLMNR requests suggest that these are coming from proxy auto-detection in Internet Settings, or in the browser settings. It looks for a device with the name "wpad" and attempts to download a proxy configuration script from it.

The ARP requests appear to becoming from the Printer / Scanner software - while the printer is off, the software scans the local network trying to find the scanner, then stops looking once the printer is turned on.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .