On Sat, Aug 04, 2001 at 08:18:05PM -0400, Brandon Caudle wrote:
> before you start to bug your cable company about arp packets you
> should know what they do.
>
> An ARP reply packet contains the hardware and protocol address of the
> machine being booted so that other machines can record its address
> resolution for future use.
>
> I have this same issue but I have a dsl and a local network I unpluged
> the dsl from the linksys router and the arp packets were still being
> brocast so no worry if you have a local lan.
Why would these arp requests occur as a steady stream, all going to
primarily one machine it looks like? This just started today. I
usually see an occasional flash of the activity light on the cable modem
but the activity light is almost burning steady now. Here is a snippet
of output from tcpdump.
23:11:45.429645 arp who-has 24.158.211.28 tell 24.158.208.1
23:11:45.597693 arp who-has 24.158.211.128 tell 24.158.208.1
23:11:45.603525 arp who-has 24.158.209.52 tell 24.158.208.1
23:11:45.648017 arp who-has 24.158.213.195 tell 24.158.208.1
23:11:45.701103 arp who-has 24.158.213.186 tell 24.158.208.1
23:11:45.799656 arp who-has 24.158.208.6 tell 24.158.208.1
23:11:45.803653 arp who-has 24.158.208.213 tell 24.158.208.1
23:11:45.807188 arp who-has 24.158.213.2 tell 24.158.208.1
23:11:45.814144 arp who-has 24.158.211.254 tell 24.158.208.1
23:11:45.833711 arp who-has 24.158.213.253 tell 24.158.208.1
23:11:45.856152 arp who-has 24.158.210.61 tell 24.158.208.1
23:11:45.906593 arp who-has 24.158.210.26 tell 24.158.208.1
23:11:45.943625 arp who-has 24.158.223.226 tell 24.158.223.129
23:11:45.949866 arp who-has 24.158.222.24 tell 24.158.222.1
23:11:45.966988 arp who-has 24.158.212.132 tell 24.158.208.1
23:11:46.052650 arp who-has 24.158.212.103 tell 24.158.208.1
23:11:46.065411 arp who-has 24.158.220.82 tell 24.158.220.1
23:11:46.156773 arp who-has 24.158.220.139 tell 24.158.220.1
23:11:46.164731 arp who-has 24.158.215.52 tell 24.158.208.1
23:11:46.169593 arp who-has 24.158.209.195 tell 24.158.208.1
It seems to me that there is some problem here. How would you suggest I
approach the cable company with this information?
> >From: Glenn Johnson <[EMAIL PROTECTED]>
> >To: Mandrake Expert <[EMAIL PROTECTED]>
> >Subject: [expert] Re: mysterious incoming packets
> >Date: Sat, 4 Aug 2001 16:43:45 -0500
> >
> >On Sat, Aug 04, 2001 at 04:24:30PM -0500, Glenn Johnson wrote:
> >
> > > I have Mandrake 8.0 with the bastille firewall set up. Today, I
> > > noticed that I have a pretty steady stream of incoming packets
> > > coming across the interface that is plugged into the cable modem,
> > > although I am not doing anything on the Internet. According
> > > to gkrellm, it is about 1.0-1.2KBps. The activity light on my
> > > cable modem is blinking pretty steadily although there is no
> > > traffic initiated by me. Could someone help me diagnose where
> > > this traffic is coming from?
> >
> >I installed tcpdump and used that to monitor the interface. I am
> >getting a steady stream of arp requests. I do not remember ever
> >seeing this before. Is this something I need to bug the cable
> >company about?
--
Glenn Johnson
[EMAIL PROTECTED]
