Routers passing on ARP requests

[bjzielinski]

We got hit pretty hard by the Welchia/Nachi worm the last couple days. I think I finally got it narrowed down to one machine and all others are patched against it. However, the routers on our network are still passing along the ARP requests for the subnet that the infected computers searched for, ie the entire subnet. It doesn't do it continuously, just about every 45 minutes or so it searches, creating a huge traffic jam. Will this eventually go away once the worm is completely gone, or do I need to stop them somehow?

Bill Zielinski
bzielinski@co.midland.mi.us
County of Midland, Michigan

 

[wybnormal]

You can flush the arp tables..

clear arp from the enabled prompt

MikeS


Find me at

http://www.packetattack.com

"Take advantage of the enemy's unreadiness, make your way by unexpected routes, and attack unguarded spots."
Sun Tzu