use tcpdump command .
[root@ad ~]# tcpdump -c 20 'ether dst ff:ff:ff:ff:ff:ff' -vv
tcpdump: listening on eth0, link-type EN10MB (Ethernet), capture size 96 bytes 21:10:59.798644 arp who-has 172.16.100.103 (Broadcast) tell 172.16.100.103 21:11:01.874895 arp who-has 172.16.100.103 (Broadcast) tell 172.16.100.103 my network setting. [root@ad ~]# ip addr list 1: lo: <LOOPBACK,UP,LOWER_UP> mtu 16436 qdisc noqueue link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00 inet 127.0.0.1/8 scope host lo inet6 ::1/128 scope host valid_lft forever preferred_lft forever 2: eth1: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast qlen 100 link/ether 00:0c:f1:a7:40:fb brd ff:ff:ff:ff:ff:ff inet 192.168.234.11/24 brd 192.168.234.255 scope global eth1 inet6 fe80::20c:f1ff:fea7:40fb/64 scope link valid_lft forever preferred_lft forever 3: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast qlen 1000 link/ether 00:0c:f1:a7:40:fc brd ff:ff:ff:ff:ff:ff inet 172.16.0.1/24 brd 172.16.0.255 scope global eth0 inet 172.16.100.103/24 brd 172.16.100.255 scope global eth0:1 inet6 fe80::20c:f1ff:fea7:40fc/64 scope link valid_lft forever preferred_lft forever 4: sit0: <NOARP> mtu 1480 qdisc noop link/sit 0.0.0.0 brd 0.0.0.0 172.16.100.103 what has found itself ? thks! |
I'm not certain what your question is. I'm assuming 172.16.100.103 is not the IP address of the system you are running the tcpdump on and you are questioning why 172.16.100.103 is asking everyone in earshot to respond if they have that IP address.
This is something that Microsoft, not normally known for innovation, actually implemented a long time ago. That system is probably just initializing its IP stack and is looking to see if someone is already using the IP address it would like to use. Linux now does that too, I believe. If that's not your question then this is not your answer, so restate. Thanks. |
All times are GMT -5. The time now is 10:31 PM. |