Their product, NetSense, an expert system for network troubleshooting, was converted initially converted into a plug-in and then later fully integrated into a new version of the product called EtherPeekNX. Savvius acquired Net3 Group in November 2000. In June 2018, Savvius was acquired by LiveAction, a company that provides network performance management, visualization and analytics software. Mid-April 2015, the company changed its name from WildPackets to Savvius and broadened its focus to include network security. However, no one was hurt and the employees regrouped at a new location and the company survived the fire. In the early morning of July 15, 2002, WildPackets' building in Walnut Creek, California burnt to the ground including everything in it. In 2003, the OmniEngine Distributed Capture Engine was released as software, and as a hardware network recorder appliance. In 2001, AiroPeek was released, which added support for wireless IEEE 802.11 (marketed with the Wi-Fi brand) networks. Earlier, LocalPeek and TokenPeek were developed for LocalTalk and Token Ring networks respectively. It was later ported to Microsoft Windows, which was released in 1997. It was the first affordable software-only protocol analyzer for Ethernet networks. The first product by the company was written for the Macintosh and was called EtherPeek. In 2000 the company changed its name to WildPackets to address the popular market it had developed for its products. Might need to increase the retire time.Savvius (formerly WildPackets) was founded in 1990 as The AG Group by Mahboud Zabetian and Tim McCreery. If you see the same IP there a lot to duplicate hosts in a short time, could be that device is not caching properly. The other part of the ARP should be 'tell '. If you see a lot of queries to a particular host, could be that host is not responding properly. Look at your sniffer output, not familiar with Etherpeek but you should see something in the form of 'who has ' where the xxx's represent a IP. In reality, you should see much less, as each host would have to be waiting just over two minutes then contacting each other host on the network.
It is possible to see a bit more, as a certain number of requests will not get answered on the first request for various reasons. If everything works correctly, the average requests per second should not exceed (H*(H-1))/120, where H is the number of hosts on your network, keeping in mind that switches, routers, print servers and just about anything else that is wired to the network counts as a host. In the end, whether or not it is normal will depend upon the type of traffic on your network. You are likely to see frequent requests from your WINS server, mail clients that are set to check for mail every 5 minutes, networked printers that are used frequently for small jobs, networked database app if there are more than two minutes between transactions - could be a long list.
DNS has nothing to do with the process - ARP resolves MAC addresses, DNS deals only with IP resolution.Īny operation that connects to another computer, waits more than two minutes then connects again will make a ARP request.
Windows ARP entries expire after 120 seconds of "domancy" by default, but are not renewed unless there is need. ARP entries are not renewed every 120 seconds.