IP scanners will send ICMP requests to all IPs in a subnet (depending on configuration). When this security device is on a different subnet from the range it is scanning, routing must occur at the switch level. Since arp entry may not exist in network, the switch must send arp request to find target. Depending on how many ports are added to a vlan, the switch by design will send an arp request for every port in that vlan (broadcast). This creates a lot of traffic from CPU and can cause instability in protocols if CPU is busy.