Re: help: duplicate MAC address
On 10/19/06, Lestat V <dreameration@gmail.com> wrote:
On 10/19/06, Javier Fernández-Sanguino Peña <jfs@computer.org> wrote:
> On Wed, Oct 18, 2006 at 11:09:35AM +0800, Lestat V wrote:
I tried "/usr/sbin/tcpdump -ei eth0 arp" for a while and got results
as excerpted as follows: (10.100.105.105 is me)
10:18:48.995807 00:07:84:52:55:3c (oui Unknown) > Broadcast, ethertype
ARP (0x0806), length 60: arp who-has 10.100.105.62 tell 10.100.105.251
10:19:36.386103 00:e0:4c:8c:a2:d1 (oui Unknown) > Broadcast, ethertype
ARP (0x0806), length 60: arp who-has 10.100.105.250 tell 10.100.105.13
10:19:53.811362 00:11:2f:57:9b:6f (oui Unknown) > Broadcast, ethertype
ARP (0x0806), length 42: arp who-has 10.100.105.13 tell 10.100.105.105
10:19:53.811774 00:07:84:52:55:3c (oui Unknown) > 00:11:2f:57:9b:6f
(oui Unknown), ethertype ARP (0x0806), length 60: arp reply
10.100.105.13 is-at 00:00:0c:07:ac:00 (oui Cisco)
10:19:53.811841 00:e0:4c:8c:a2:d1 (oui Unknown) > 00:11:2f:57:9b:6f
(oui Unknown), ethertype ARP (0x0806), length 60: arp reply
10.100.105.13 is-at 00:e0:4c:8c:a2:d1 (oui Unknown)
^^^^^^^^^^^^^^^^^ got two MAC's for .13
10:20:24.103025 00:07:84:52:55:3c (oui Unknown) > Broadcast, ethertype
ARP (0x0806), length 60: arp who-has 10.100.105.138 tell
10.100.105.251
10:20:43.356138 00:07:84:52:55:3c (oui Unknown) > Broadcast, ethertype
ARP (0x0806), length 60: arp who-has 10.100.105.205 tell
10.100.105.251
10:22:27.486335 00:11:2f:57:9b:6f (oui Unknown) > Broadcast, ethertype
ARP (0x0806), length 42: arp who-has 10.100.105.14 tell 10.100.105.105
10:22:27.486774 00:07:84:52:55:3c (oui Unknown) > 00:11:2f:57:9b:6f
(oui Unknown), ethertype ARP (0x0806), length 60: arp reply
10.100.105.14 is-at 00:00:0c:07:ac:00 (oui Cisco)
^^^^^^^^^^^^^^^^^^this time got one MAC for .14
10:28:24.678589 00:11:2f:57:9b:6f (oui Unknown) > Broadcast, ethertype
ARP (0x0806), length 42: arp who-has 10.100.105.99 tell 10.100.105.105
10:28:24.678930 00:11:2f:7c:e6:83 (oui Unknown) > 00:11:2f:57:9b:6f
(oui Unknown), ethertype ARP (0x0806), length 60: arp reply
10.100.105.99 is-at 00:11:2f:7c:e6:83 (oui Unknown)
10:28:24.679134 00:07:84:52:55:3c (oui Unknown) > 00:11:2f:57:9b:6f
(oui Unknown), ethertype ARP (0x0806), length 60: arp reply
10.100.105.99 is-at 00:00:0c:07:ac:00 (oui Cisco)
^^^^^^^^^^^^^^^^^two MAC for .99
10:30:31.190723 00:07:84:52:55:3d (oui Unknown) > Broadcast, ethertype
ARP (0x0806), length 60: arp who-has 10.100.105.115 tell
10.100.105.252
From above can we deduce that .251 .252 are gateway, and .99 and .13
reside in the same subnet as .105, while .14 and .88 reside outside?
Reply to: