We're seeing some suspicious network activity, and when I was trying to see if it was one particular server of ours I ran a Wireshark trace. I noted a lot of ARP packets asking who has x.x.x.x
, but all being told to tell different addresses. In the past I've only seen the "tell" to be a single host - for example a DHCP server.
As you can see from the screenshot, there are only a few IP's being asked for, but the system to tell varies a lot. It's like all devices on the network are trying to find out who 10.10.0.40
(and a couple of others) is.
This is normal, especially if whatever at 10.10.0.40 is turned off or disconnected. For example, if 10.10.0.40 is a DNS server and everyone is configured to use it as their primary DNS server then you will get a lot of machines asking for that address. But since it's not on, they will ask a lot and get no response.
That doesn't look out of the ordinary to me, assuming that your 10.10.0.40 address belongs to a sever / printer / other shared resource and your users are on the same subnet & switch.
As suggested by Tim Brigham, this is not out of the ordinary. The devices are doing ARP requests to get the MAC address (layer 2 address) for the 10.10.0.40 address. By having the MAC address, the hosts will be able to connect to it directly, without having to include a Layer3 hop.
For example, if all hosts are on the same subnet and same switch, the machines can connect to 10.10.0.40 without going to a router first (which is necessary for connections on a different network).