ARP storm issues ?

[Baxter]

I appear to have some kind of ARP broadcast storm that takes down my network for a few seconds about 3 times a day.

my Asus AC88u router running 380.66.4 sends the following ARP packet few thousand times with 1 second :
Broadcast ARP 60 Who has 192.168.1.218? Tell 192.168.1.1

after about 100 of the above frames my iPhone6s starts doing:
ICMPv6 Router Solicitation

then those 2 messages alternate for few thousand times before they stop.
Broadcast ARP 60 Who has 192.168.1.218? Tell 192.168.1.1
ICMPv6 Router Solicitation
Broadcast ARP 60 Who has 192.168.1.218? Tell 192.168.1.1
ICMPv6 Router Solicitation
Broadcast ARP 60 Who has 192.168.1.218? Tell 192.168.1.1
ICMPv6 Router Solicitation
Broadcast ARP 60 Who has 192.168.1.218? Tell 192.168.1.1
ICMPv6 Router Solicitation
<repeat for at least 1000 times>

I captured this with Wireshark with multicast capture filer so I did not capture any uni-cast traffic during this time.

any ideas what is going on ?
Bax

 

[Fitz Mutch]

I appear to have some kind of ARP broadcast storm that takes down my network ...

I just disabled this on my RT-AC68U, so we'll see what happens now.

To disable the arpstorm program, you might be able to unset its NVRAM variable. Will doing this prevent it from running?
https://github.com/RMerl/asuswrt-merlin/blob/master/release/src/router/rc/ate.c#L1687

OR, you could disable it another way like I did on my router.

/jffs/scripts/init-start

#!/bin/sh
/usr/bin/killall arpstorm
/bin/mount -o bind /dev/null /usr/sbin/arpstorm

 

[Baxter]

not sure I understand your response. Do you have the same issue ? is the Asus router doing this on purpose via 'arpstorm' executable ? If so, why ?

 

[Baxter]

I should also add at the exact same time as this ARP storm my router logs:

Jul 10 17:50:10 kernel: net_ratelimit: 10 callbacks suppressed
Jul 10 17:50:15 kernel: net_ratelimit: 1443 callbacks suppressed
Jul 10 17:50:22 kernel: net_ratelimit: 45 callbacks suppressed

 

[Fitz Mutch]

not sure I understand your response. Do you have the same issue ? is the Asus router doing this on purpose via 'arpstorm' executable ? If so, why ?

I do not have the issue you describe. My RT-AC68U runs fine. There's probably a good reason for having the arpstorm program, but I just don't know. My network is very simple; I don't need most features.

 

[RMerlin]

arpstorm is used by networkmap to initiate a network-wide scan.

 

[Baxter]

btw, the cause of the ARP storm issue was my Samsung TV which was connected via WiFi to my network. I never use any of its poorly designed features, so I just disabled its WiFi.