Help answer threads with 0 replies.
Go Back > Forums > Linux Forums > Linux - Networking
User Name
Linux - Networking This forum is for any issue related to networks or networking.
Routing, network cards, OSI, etc. Anything is fair game.


  Search this Thread
Old 09-23-2005, 06:45 PM   #1
Registered: May 2005
Distribution: CENTOS
Posts: 91

Rep: Reputation: 15
a lot of ARP requests- why?

Hi there,

I am playing with tcpdump (learning) and noticed huge ammount of ARP trafic on my external interface but actualy non of hem originated or destined for my IP.
I am wondering why?
I am on cable connection. Am I on some kind of hub so that I can actually listen traffic around me or....??
Just to stress that my IP is not even on same subnet with any of these guys.

15:36:13.351630 arp who-has tell
15:36:13.351863 arp who-has tell
15:36:13.369831 arp who-has tell
15:36:13.370058 arp who-has tell
15:36:13.374676 arp who-has tell
15:36:13.374903 arp who-has tell
15:36:13.382823 arp who-has tell
15:36:13.383052 arp who-has tell
15:36:13.395406 arp who-has tell
15:36:13.395631 arp who-has tell
15:36:13.476531 arp who-has tell
15:36:13.476766 arp who-has tell
15:36:13.492559 arp who-has tell
15:36:13.492784 arp who-has tell

Old 09-24-2005, 04:32 PM   #2
Registered: Jun 2005
Location: q3dm7
Distribution: Mandriva 2010.0 x86_64
Posts: 338

Rep: Reputation: 31
It looks like you're picking up ARP broadcast traffic from a number of Shaw gateways. I'd ask Shaw about that if I were you - it seems unusual.
Old 09-24-2005, 04:35 PM   #3
Registered: Feb 2002
Location: Grenoble
Distribution: Debian
Posts: 9,551

Rep: Reputation: 161Reputation: 161
There may be a hub. There also may be incorrectly configured clients, cable modems etc. You probably need to live with it. What's more, you'll see things much more strange than this...
Old 09-25-2005, 01:29 AM   #4
Registered: Jun 2005
Posts: 542

Rep: Reputation: 34
I'm not using a cable connection, but I could try shutting down those requests with false replies to one of your ISP's servers so they notice it
Old 09-25-2005, 04:42 PM   #5
Registered: May 2005
Distribution: CENTOS
Posts: 91

Original Poster
Rep: Reputation: 15
I'll try to contact my ISP...problem is on their side obviously.

Thanks for replies, guys!
Old 09-26-2005, 09:06 AM   #6
Registered: Sep 2004
Distribution: Debian, Ubuntu, BeatrIX, OpenWRT
Posts: 273

Rep: Reputation: 30
They may very well tell you that this is normal behaviour. These are arp-requests, which are broadcasts. Hence, everyone on the same ethernet-subnet will receive them. One ethernet-subnet may very well host multiple ip-subnets.

If this is normal behaviour, and you are generating false replies, you may very well find out that your account will get blocked.




Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off

Similar Threads
Thread Thread Starter Forum Replies Last Post
Strange ARP behavior : A linux server responds to all ARP requests Hdvd21 Linux - Networking 4 10-24-2013 06:02 AM
Cutting arp requests to my box ivanatora Linux - Security 5 08-30-2004 03:46 PM
Many arp requests norman in tcpdump? af_dave Linux - Networking 0 08-21-2004 09:01 AM
Why am I flooding my network with ARP requests? DocKarl Linux - Networking 3 05-07-2004 12:50 PM
How to monitor the ARP requests from other than eth1 Bassam Linux - Networking 4 02-10-2004 04:25 AM

All times are GMT -5. The time now is 04:10 PM.

Main Menu
Write for LQ is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
Facebook: linuxquestions Google+: linuxquestions
Open Source Consulting | Domain Registration