0

TLDR; PC is sending ARP Who is requests for a link local address 169.254.xxx.xxx continuously every second. Only on this device.


My PC begins to send constant ARP requests to the router for "Who has 169.254.255.255"? From my limited understanding I assume this is due to an inability of the DHCP to assign an IP address? But how does this make sense.

I run on DHCP but use limited leases (5 for the number of home devices). Only my system seems to be sending these floods. For context I recently disabled UPnP and ICMPv4. I assume blocking ICMPv4 traffic is causing this behavior?

Also another angle I'm holding is my worry of being compromised. Reason being for me tightening up my firewall rules and limiting traffic with ICMP and UPNP functionality. Could this be malware related at a stretch if nothing else explains?

1 Answer 1

2

Partial answer:

  • One request every second isn't "flooding".
  • DHCP doesn't assign link-local addresses, nor is it involved with link-local addresses in any way, so you can't fix this via DHCP.
  • ARP requests are not sent "to the router", they are broadcast to everyone in the LAN segment. The computer with this address is supposed to respond.
  • If your PC sends ARP requests, it's either looking for someone with 169.254.255.255, or it wants this address for itself. So the first step is to check which addresses are assigned to this PC.
  • If the PC wants 169.254.255.255 for itself, disable assignment of link-local addresses to interfaces (details depend on OS).
  • If the PC wants to communicate with 169.254.255.255, find out which application wants to do that, and stop this application from doing so.

I have limited leases for the precise number of devices and i know what each IP is

Again: Link local addresses are not managed by DHCP. They don't have leases. Each device is free to assign itself one address.

I check my router logs and theres no Mac address or device associated with the link local address.

Of course, because the router doesn't keep track of link local addresses.

Not sure what application has the authority to send ARP requests

Anything using the network stack can send out ARP requests (which is handled by the OS). On top, the OS can assign itself link local addresses (to repeat, without having leases, and without asking the router), and that will cause a broadcast to verify if this address is taken.

Does this mean there IS a device currently using that link local address

It's possible. It's a link local address, there's no track of which device assigned itself which address. The only way to find out is to log in to each and every device, and check the assigned IP addresses.

2
  • Hi Dirkt this is the issue think i didnt make it clear in my explanation. So the link local address that my PC is broadcasting to the network does not belong to any device WHATSOEVER. Thats whats tripping me out. I have limited leases for the precise number of devices and i know what each IP is. I check my router logs and theres no Mac address or device associated with the link local address. The weird thing is my pc, the only device on the network is sending these broadcast requests for 'Who is 164.254.255.255'. Not sure what application has the authority to send ARP requests
    – N S
    Nov 9, 2021 at 8:34
  • Does this mean there IS a device currently using that link local address. if so that's a concerning thought. All devices are accounted for
    – N S
    Nov 9, 2021 at 8:35

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .