Why is there a constant ARP request from the gateway?

Question

Network administration

a huge number of such lines in tcpdump
17:56:09.495341 ARP, Request who-has xx.xx.xx.91 tell xx.xx.xx.65, length 28
17:56:09.496031 ARP, Reply xx.xx.xx.91 is-at c4:a8:1d:dd:e5:83, length 46
17:56:10.495443 ARP, Request who-hasxx.xx.xx.91 tell xx.xx.xx.65, length 28
17:56:10.496313 ARP, Reply xx.xx.xx.91 is-at c4:a8:1d:dd:e5:83, length 46
17:56:11.495621 ARP, Request who-has xx.xx.xx.91 tell xx.xx. xx.65, length 28 91 -
user
65 - gateway
for other IPs from the same subnet, there are no such nuances. Tell me what it is and how to overcome it.
Thank you.

Answer 1

This is how the IP protocol works.
Apparently, before each packet outside your network perimeter to a new IP, your PC knocks on the gateway in order to establish a connection.

Answer 2

and how to overcome

What for? From the listing you provided, there is traffic in the form of one arp request per second . If this represents a significant load on your network, then I think you are doing something wrong.

what is this

I'm a bit of an expert on the Linux networking subsystem, but I have the following thoughts. First, you should make sure that it is the gateway that sends the requests (take a traffic dump from the gateway, filtering out ARP requests from the outside for a while). Secondly, it is worth checking whether the corresponding entry is correctly created in the gateway's arp table when a response is received. Thirdly, it is worth looking for differences between this host and any other for which this behavior is not observed. There is an assumption that in this way the dhcp server (if it is active on the gateway) checks the activity of the host and, therefore, the demand for the address issued to the host.