LinuxQuestions.org
View the Most Wanted LQ Wiki articles.
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Networking
User Name
Password
Linux - Networking This forum is for any issue related to networks or networking.
Routing, network cards, OSI, etc. Anything is fair game.

Notices

Reply
 
Search this Thread
Old 11-22-2009, 09:41 AM   #1
Thor_2.0
Senior Member
 
Registered: Nov 2007
Location: Somewhere on my hard drive...
Distribution: Manjaro
Posts: 2,209
Blog Entries: 23

Rep: Reputation: 279Reputation: 279Reputation: 279
ARP wants to know...


Hi,

I was answering some questions at Yahoo's when I got a message after submitting my answer, that they couldn't process the request, possibly due to spyware...

Those of you who know me, will understand that I freaked out, so I ran a tcpdump and got request

Quote:
16:30:52.042050 arp who-has 192.168.5.5 tell 192.168.1.1
16:30:52.094023 arp reply 192.168.5.5 is-at [MAC address] (oui Unknown)
16:30:57.042692 arp who-has 192.168.1.1 tell 192.168.1.51
16:30:57.043008 arp reply 192.168.1.1 is-at [MAC address] (oui Unknown)
Strange thing is that both IP addresses are known, and the one with 192.168.1.1 is my router.

I am 99% sure I am not hacked, just help me with the ONE last procent.

Is this a normal "conversation" in a LAN?

Tnx

Thor
 
Old 11-22-2009, 09:48 AM   #2
repo
LQ 5k Club
 
Registered: May 2001
Location: Belgium
Distribution: Linux Mint
Posts: 8,501

Rep: Reputation: 883Reputation: 883Reputation: 883Reputation: 883Reputation: 883Reputation: 883Reputation: 883
Quote:
Is this a normal "conversation" in a LAN?
yes
http://www.erg.abdn.ac.uk/users/gorr...pages/arp.html
 
Old 11-22-2009, 09:49 AM   #3
repo
LQ 5k Club
 
Registered: May 2001
Location: Belgium
Distribution: Linux Mint
Posts: 8,501

Rep: Reputation: 883Reputation: 883Reputation: 883Reputation: 883Reputation: 883Reputation: 883Reputation: 883
Quote:
I was answering some questions at Yahoo's when I got a message after submitting my answer, that they couldn't process the request, possibly due to spyware...
Seems to me the problem is yahoo.
Can't you get more info?
 
Old 11-22-2009, 09:56 AM   #4
Thor_2.0
Senior Member
 
Registered: Nov 2007
Location: Somewhere on my hard drive...
Distribution: Manjaro
Posts: 2,209
Blog Entries: 23

Original Poster
Rep: Reputation: 279Reputation: 279Reputation: 279
Thanks!

I tried to retrace my steps and it did'nt do that anymore...so...yup, it's Yahoo...

Tanks for that one extra procent, I'm 100% sure again, and learned something in the process!

CU!!

Thor
 
  


Reply

Tags
arp, lan, networking


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off


Similar Threads
Thread Thread Starter Forum Replies Last Post
Strange ARP behavior : A linux server responds to all ARP requests Hdvd21 Linux - Networking 4 10-24-2013 05:02 AM
arp poisoning vs arp spoofing sulekha Linux - Networking 1 05-13-2009 04:22 AM
arp who-has? tell? macroron Linux - Networking 4 12-21-2007 05:49 AM
Disabling ARP probes after receiving an ARP request AltecLansingMan Linux - Networking 1 03-30-2004 01:25 PM
How to create an proxyarp entry in arp table by using arp command? himalayas Linux - Networking 0 06-04-2003 04:14 AM


All times are GMT -5. The time now is 08:39 AM.

Main Menu
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
identi.ca: @linuxquestions
Facebook: linuxquestions Google+: linuxquestions
Open Source Consulting | Domain Registration