Look at the source and destination addresses. The shared-media aspect of cable means you pretty much see all your neighbors' traffic, including arp broadcasts. If it's much higher than normal, and you're seeing an address trying to connect to many many machines at a time (especially within a range of ip addresses) then you've probably got an infected neighbor.
On Mon, 2003-09-08 at 20:13, Wade wrote: > Is it just me or is anybody else on cox getting pounded with ARP. > I'm getting roughly around 450 ARP's a minute. I first notice my mrtg > graph higher than normal, so i started digging around. This is the only > thing i can find. > > Wade > > > > > _______________________________________________ > General mailing list > [email protected] > http://brlug.net/mailman/listinfo/general_brlug.net
