At 10:18 PM 3/20/02, John Green wrote: >my box (windows workstation) is connected to a cable >modem (i guess motorola) and cable modem connects to >my cable tv network and in turn to internet.
That's typical. So you were doing the ARP -A on a Windows machine, I guess. And you're seeing remote stations in the ARP cache with a Physical address of 00-05-5f-ee-e0-54. (You never answered what those IP addresses are. On your own local network or remote? I'll assume remote since it sounds like your network is just your PC and cable modem.) 00-05-5f-ee-e0-54 is the physical address of a Cisco router. It's probably a router at your service provider. I bet your PC is ARPing for remote stations and the Cisco router is doing Proxy ARP. A PC ARPs for remote stations under a few conditions: The PC thinks the stations are local due to a subnet mask issue. The PC doesn't have a default gateway configured. The PC has the default gateway configured to be itself. (the same address as assigned to the PC.) You could check your network control panel. Relying on proxy ARP is pretty typical for dial-access. I haven't seen it with cable modem service. On the cable modem network that I support, the PCs get the address of an actual gateway (router) from the DHCP server. They only ARP for local stations and the default gateway. But there's nothing wrong with doing it the other way. Priscilla >--- Priscilla Oppenheimer wrote: > > At 08:05 PM 3/18/02, John Green wrote: > > >i guess you are right that there is some sort of > > >filtering being done. > > >because the arp command gives the same physical > > >address of the hosts in my subnet. > > > > Where are you running this ARP command? On a router, > > on a workstation? What > > does your network look like? > > > > > > >Internet Address Physical Address Type > > >211.16.12.1 00-05-5f-ee-e0-54 dynamic > > >211.16.13.14 00-05-5f-ee-e0-54 dynamic > > > > 00-05-5F is Cisco's vendor code. Perhaps it's your > > default gateway? What > > are the 211.16 addresses? Are they your local > > machines? > > > > I think we need more info to answer the question.... > > But perhaps knowing > > that the MAC address is a Cisco device will help. It > > could be the default > > gateway or the UBR at the service provider's > > network. But with no more info > > about your topology, I'm just guessing. > > > > Priscilla > > > > > > >for all other hosts as well the physical address is > > >same as above. I guess the physical address is of > > the > > >access server that out host is connecting to (or > > >rather for the same subnet all hosts connect to > > this > > >same access server, could be a dhcp server as > > well). > > > > > >i guess it is a switched environment. but still the > > >physical address for different hosts should show up > > as > > >different. > > >anyone knows what is going on here ???? > > > > > > > > > > > >--- sam sneed wrote: > > > > I just changed services from DSL to cable modem. > > I > > > > have heard from people, > > > > including verizon, that cable is not as secure > > as > > > > DSL becuase it is over a > > > > shared medium. I connected to my cable modem and > > > > fired up my packet sniffer. > > > > I did not see anyone elses traffic on the line > > so i > > > > am assuming the bandwith > > > > is shared( a known fact about cable access) but > > is > > > > somehow filtered at the > > > > cable modem(bridge). Does anyone know if this > > > > assumption is true and the > > > > inside details of the how data is transmitted > > over > > > > the cable network? A link > > > > to a whitepaer would be great. > > > > > > > > thanks ________________________ Priscilla Oppenheimer http://www.priscilla.com Message Posted at: http://www.groupstudy.com/form/read.php?f=7&i=39075&t=38705 -------------------------------------------------- FAQ, list archives, and subscription info: http://www.groupstudy.com/list/cisco.html Report misconduct and Nondisclosure violations to [EMAIL PROTECTED]
