[Date Prev][Date Next] [Thread Prev][Thread Next] [Date Index] [Thread Index]

Re: Re: Funky Arp Stuff

This is a cable network.  The systems are configured correctly (10.67 is what the ISP uses for the addresses of the cable modems themselves (the bridges))  I found out, from calling my ISP, that several users were having SubSeven issues (<dummy mode> duhhhh....why do we need a firewall onour broadband? </dummy mode>)  These machines were reportedly doing network scans.  Anyhow, since my post things have calmed down significantly.  I know ARP is normal, but 40 or 50+ ARP request per second was a bit excessive <G>.  Especially on a network where people are ONLY supposed to talk to the gateway....(Cable network)

Thanks to all those who replied (privately and publically),


-----Original Message-----
From: Michael Wood <mwood@its.uct.ac.za>
To: debian-security@lists.debian.org
Date: Mon, 7 Jan 2002 10:39:22 +0200
Subject: Re: Funky Arp Stuff

On Sun, Jan 06, 2002 at 01:52:45PM -0500, Phillip Hofmeister wrote:
> My computer is rambling on over eth0 (External interface)
> about a bunch of ARP request.  Any Idea what could cause it?

20:50:05.245819 arp who-has tell
20:50:05.367348 arp who-has tell
20:50:05.418712 arp who-has tell
20:50:05.419229 arp who-has tell
20:50:05.427456 arp who-has tell
20:50:05.453245 arp who-has tell
20:50:05.464775 arp who-has tell
20:50:05.465226 arp who-has tell
20:50:05.488555 arp who-has tell
20:50:05.489197 arp who-has tell
20:50:05.489659 arp who-has tell
20:50:05.556405 arp who-has tell
20:50:05.578308 arp who-has tell
20:50:05.641715 arp who-has tell
20:50:05.696083 arp who-has tell

You have a machine on your network with IP address
trying to talk to other machines with IP addresses in the range
10.67.178.x, which appear not to exist.

You also have a machine with the IP address and
another with the IP address is most likely misconfigured.  The other two
resolve, so maybe they're OK, but they didn't get ARP replies,
according to your packet capture.

Is your machine connected to the 'net via DSL or cable or

Michael Wood <mwood@its.uct.ac.za>

To UNSUBSCRIBE, email to debian-security-request@lists.debian.org
with a subject of "unsubscribe". Trouble? Contact listmaster@lists.debian.org

Reply to: