>>
Why do the logs show arp replys to ip numbers that are not
currently working . I mean , I have a class C network address , and I
have configured my domain with all the numbers and everything , but by
looking at the logs , I discovered arp replys to machines that are not
working ,and also arp replys to every single machine within my domain .
Is this normal? or is someone getting information about my network, (
that is what I think ,) and if that is the case , how do I know who is
doing this requests ?
this one is an ip number not in use.
22:21:46.409666 arp who-has compu143.compu-redes.net.mx tell
kraken2.compu-redes.net.mx
<<
That isn't an arp reply, it's an arp query. This means that kraken2 is trying
to find the mac address of compu143. Why? I don't know. You should look
carefully into what's going on with kraken2.
Tony Rall
-
[To unsubscribe, send mail to [EMAIL PROTECTED] with
"unsubscribe firewalls" in the body of the message.]
