LinuxQuestions.org
Download your favorite Linux distribution at LQ ISO.
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Networking
User Name
Password
Linux - Networking This forum is for any issue related to networks or networking.
Routing, network cards, OSI, etc. Anything is fair game.

Notices

Reply
 
Search this Thread
Old 09-23-2005, 05:45 PM   #1
zivota
Member
 
Registered: May 2005
Distribution: CENTOS
Posts: 91

Rep: Reputation: 15
a lot of ARP requests- why?


Hi there,

I am playing with tcpdump (learning) and noticed huge ammount of ARP trafic on my external interface but actualy non of hem originated or destined for my IP.
I am wondering why?
I am on cable connection. Am I on some kind of hub so that I can actually listen traffic around me or....??
Just to stress that my IP is not even on same subnet with any of these guys.


example
------------
15:36:13.351630 arp who-has 24.86.201.37 tell 24.86.200.1
15:36:13.351863 arp who-has 24.86.201.37 tell 24.86.200.1
15:36:13.369831 arp who-has 24.85.76.160 tell 24.85.76.1
15:36:13.370058 arp who-has 24.85.76.160 tell 24.85.76.1
15:36:13.374676 arp who-has 24.86.203.3 tell 24.86.200.1
15:36:13.374903 arp who-has 24.86.203.3 tell 24.86.200.1
15:36:13.382823 arp who-has 24.85.86.60 tell 24.85.84.1
15:36:13.383052 arp who-has 24.85.86.60 tell 24.85.84.1
15:36:13.395406 arp who-has 24.86.194.62 tell 24.86.192.1
15:36:13.395631 arp who-has 24.86.194.62 tell 24.86.192.1
15:36:13.476531 arp who-has 24.86.203.212 tell 24.86.200.1
15:36:13.476766 arp who-has 24.86.203.212 tell 24.86.200.1
15:36:13.492559 arp who-has 24.85.88.11 tell 24.85.88.1
15:36:13.492784 arp who-has 24.85.88.11 tell 24.85.88.1


Thanks!
 
Old 09-24-2005, 03:32 PM   #2
Snowbat
Member
 
Registered: Jun 2005
Location: q3dm7
Distribution: Mandriva 2010.0 x86_64
Posts: 338

Rep: Reputation: 30
It looks like you're picking up ARP broadcast traffic from a number of Shaw gateways. I'd ask Shaw about that if I were you - it seems unusual.
 
Old 09-24-2005, 03:35 PM   #3
Mara
Moderator
 
Registered: Feb 2002
Location: Grenoble
Distribution: Debian
Posts: 9,536

Rep: Reputation: 148Reputation: 148
There may be a hub. There also may be incorrectly configured clients, cable modems etc. You probably need to live with it. What's more, you'll see things much more strange than this...
 
Old 09-25-2005, 12:29 AM   #4
primo
Member
 
Registered: Jun 2005
Posts: 542

Rep: Reputation: 34
I'm not using a cable connection, but I could try shutting down those requests with false replies to one of your ISP's servers so they notice it
 
Old 09-25-2005, 03:42 PM   #5
zivota
Member
 
Registered: May 2005
Distribution: CENTOS
Posts: 91

Original Poster
Rep: Reputation: 15
I'll try to contact my ISP...problem is on their side obviously.

Thanks for replies, guys!
 
Old 09-26-2005, 08:06 AM   #6
kees-jan
Member
 
Registered: Sep 2004
Distribution: Debian, Ubuntu, BeatrIX, OpenWRT
Posts: 273

Rep: Reputation: 30
They may very well tell you that this is normal behaviour. These are arp-requests, which are broadcasts. Hence, everyone on the same ethernet-subnet will receive them. One ethernet-subnet may very well host multiple ip-subnets.

If this is normal behaviour, and you are generating false replies, you may very well find out that your account will get blocked.

Groetjes,

Kees-Jan
 
  


Reply


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off


Similar Threads
Thread Thread Starter Forum Replies Last Post
Strange ARP behavior : A linux server responds to all ARP requests Hdvd21 Linux - Networking 4 10-24-2013 05:02 AM
Cutting arp requests to my box ivanatora Linux - Security 5 08-30-2004 02:46 PM
Many arp requests norman in tcpdump? af_dave Linux - Networking 0 08-21-2004 08:01 AM
Why am I flooding my network with ARP requests? DocKarl Linux - Networking 3 05-07-2004 11:50 AM
How to monitor the ARP requests from other than eth1 Bassam Linux - Networking 4 02-10-2004 03:25 AM


All times are GMT -5. The time now is 11:18 AM.

Main Menu
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
identi.ca: @linuxquestions
Facebook: linuxquestions Google+: linuxquestions
Open Source Consulting | Domain Registration