[c-nsp] Arp Inspection Rate Limit

[NMaio at guesswho.com]

Found the problem with the print sever to actually be a broadcast NTP packet sent from the print server which in turn made the machines on the subnet do an arp request which in turn made the print server send arp responses.  The arp responses were the reason the port would exceeded the threshold.  The ntp setting had to be changed and it is running nicely now.
Thanks,
Nick

-----Original Message-----
From: cisco-nsp-bounces at puck.nether.net [mailto:cisco-nsp-bounces at puck.nether.net] On Behalf Of Alexander Clouter
Sent: Wednesday, August 19, 2009 5:59 AM
To: cisco-nsp at puck.nether.net
Subject: Re: [c-nsp] Arp Inspection Rate Limit

Hi,

NMaio at guesswho.com wrote:
>
> Thanks for the response.  Funny you mention the print server because
> that happens to be one device port I need to tweak since it occasionally
> exceeds the 15 pps.
>
We have been fine at 10 for over a year now[1], however it took us a
while to figure out that for some bizarre reason[2] 'File and Print
Sharing' being enabled actually caused the workstation to flood ping the
local subnet looking for printers everytime someone pressed <Print> on
their workstation.

Similar thing happens under Vista only when you want to add an IPP
printer by hand :-/

Cheers

[1] we are a university with about 600 staff and 3000 students
[2] might be linked to Novell being installed too, but who knows

--
Alexander Clouter
.sigmonster says: There's enough money here to buy 5000 cans of Noodle-Roni!

_______________________________________________
cisco-nsp mailing list  cisco-nsp at puck.nether.net
https://puck.nether.net/mailman/listinfo/cisco-nsp
archive at http://puck.nether.net/pipermail/cisco-nsp/