a lot of ARP requests- why?
 

Hi there,

I am playing with tcpdump (learning) and noticed huge ammount of ARP trafic on my external interface but actualy non of hem originated or destined for my IP.
I am wondering why?
I am on cable connection. Am I on some kind of hub so that I can actually listen traffic around me or....??
Just to stress that my IP is not even on same subnet with any of these guys.


example
------------
15:36:13.351630 arp who-has 24.86.201.37 tell 24.86.200.1
15:36:13.351863 arp who-has 24.86.201.37 tell 24.86.200.1
15:36:13.369831 arp who-has 24.85.76.160 tell 24.85.76.1
15:36:13.370058 arp who-has 24.85.76.160 tell 24.85.76.1
15:36:13.374676 arp who-has 24.86.203.3 tell 24.86.200.1
15:36:13.374903 arp who-has 24.86.203.3 tell 24.86.200.1
15:36:13.382823 arp who-has 24.85.86.60 tell 24.85.84.1
15:36:13.383052 arp who-has 24.85.86.60 tell 24.85.84.1
15:36:13.395406 arp who-has 24.86.194.62 tell 24.86.192.1
15:36:13.395631 arp who-has 24.86.194.62 tell 24.86.192.1
15:36:13.476531 arp who-has 24.86.203.212 tell 24.86.200.1
15:36:13.476766 arp who-has 24.86.203.212 tell 24.86.200.1
15:36:13.492559 arp who-has 24.85.88.11 tell 24.85.88.1
15:36:13.492784 arp who-has 24.85.88.11 tell 24.85.88.1


Thanks!

It looks like you're picking up ARP broadcast traffic from a number of Shaw gateways. I'd ask Shaw about that if I were you - it seems unusual.

There may be a hub. There also may be incorrectly configured clients, cable modems etc. You probably need to live with it. What's more, you'll see things much more strange than this...

I'm not using a cable connection, but I could try shutting down those requests with false replies to one of your ISP's servers so they notice it ;)

I'll try to contact my ISP...problem is on their side obviously.

Thanks for replies, guys!

They may very well tell you that this is normal behaviour. These are arp-requests, which are broadcasts. Hence, everyone on the same ethernet-subnet will receive them. One ethernet-subnet may very well host multiple ip-subnets.

If this is normal behaviour, and you are generating false replies, you may very well find out that your account will get blocked.

Groetjes,

Kees-Jan