ARP

[Promedia]

There is arp storm on my network, what can be the reason of this??

 

[GWINTO]

Run network monitor on your server when the traffic is heavy, take a capture and if there are a number of arp broadcasts running incramental through your IP address scope then you have got a virus on the sending machine, if you suspect this is the case check for the following registry keys
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services

RpcPatch
RpcTftpd

If you have these then you will need to run the clean up tool, check out this link:

http://securityresponse.symantec.com/avcenter/venc/data/w32.welchia.worm.html

The more you know, the more you realise there is to know....
CCNA MCP

 

[Promedia]

Gwinto

Thanks for the reply, I discovert that its was indeed a virus (goabot) and I was able to remove it

many thanks

Promedia