Windows Media Player and arp-inspection

[baddos]

I'm experiencing a strange problem with Vista desktops using Media Player. What appears to be happening, is the machines that play a movie file for some reason generate a ton of arp packets. This is using a local file too, not streaming or anything like that.

I haven't been able to capture the packets so far yet, because it doesn't happen every time they do it. But it does generate arp-inspection rate limit protections on my switches.

Apr 25 18:35:03.044: %SW_DAI-4-PACKET_RATE_EXCEEDED: 16 packets received in 883 milliseconds on Fa5/34.
Apr 25 18:35:03.044: %PM-4-ERR_DISABLE: arp-inspection error detected on Fa5/34, putting Fa5/34 in err-disable state

Has anyone seen this behavior happening on their networks? Maybe there is a patch for media player or such that would shut it up.

 

[burtsbees]

Looks like it's trying to connect to the internet. An err-disable state usually means a cable problem, though. Post a sh int on both ends of that link.

Burt

 

[baddos]

It's a host port, and the problem only happens when the host plays a video from media player. The port goes into err-disable because arp-inspection gets too many arp requests at the same time so it shuts it down to save it's CPU from a DOS attack.

The problem is why is media player doing this in the first place? I've looked all over, but can't seem to find people talking about this problem.