Sure, here is a longer dump: Thu Jun 14 07:53:58 2001; ARP request for 212.127.171.4; eth0; 46 bytes; from 00105af50a40 to ffffffffffff Thu Jun 14 07:53:58 2001; ARP request for 212.127.136.17; eth0; 46 bytes; from 080020c200cb to ffffffffffff Thu Jun 14 07:53:58 2001; ARP request for 212.127.140.26; eth0; 46 bytes; from 0030a32d7470 to ffffffffffff Thu Jun 14 07:53:58 2001; ARP request for 212.127.248.4; eth0; 46 bytes; from 00e04c6904a4 to ffffffffffff Thu Jun 14 07:53:58 2001; UDP; eth0; 213 bytes; from 212.127.147.209:1025 to 212.127.151.255:138 Thu Jun 14 07:53:58 2001; ARP request for 195.66.30.117; eth0; 46 bytes; from 0030a32d7470 to ffffffffffff Thu Jun 14 07:53:58 2001; ARP request for 212.127.131.132; eth0; 46 bytes; from 0030a32d7470 to ffffffffffff Thu Jun 14 07:53:58 2001; ARP request for 212.127.181.232; eth0; 46 bytes; from 0030a32d7470 to ffffffffffff Thu Jun 14 07:53:58 2001; ARP request for 212.127.166.78; eth0; 46 bytes; from 0030a32d7470 to ffffffffffff Thu Jun 14 07:53:58 2001; UDP; eth0; 213 bytes; from 212.127.147.209:1025 to 212.127.151.255:138 Thu Jun 14 07:53:58 2001; ARP request for 212.127.154.4; eth0; 46 bytes; from 0050dac112ad to ffffffffffff Thu Jun 14 07:53:58 2001; ARP request for 212.127.152.93; eth0; 46 bytes; from 0030a32d7470 to ffffffffffff Thu Jun 14 07:53:58 2001; ARP request for 212.127.178.89; eth0; 46 bytes; from 0030a32d7470 to ffffffffffff Thu Jun 14 07:53:58 2001; ARP request for 195.66.24.5; eth0; 46 bytes; from 00409500f764 to ffffffffffff Thu Jun 14 07:53:58 2001; ARP request for 212.127.167.156; eth0; 46 bytes; from 0030a32d7470 to ffffffffffff Thu Jun 14 07:53:58 2001; ARP request for 212.127.171.4; eth0; 46 bytes; from 0010a7033eea to ffffffffffff Thu Jun 14 07:53:58 2001; ARP request for 63.161.205.100; eth0; 46 bytes; from 0010a70167e1 to ffffffffffff Thu Jun 14 07:53:58 2001; ARP request for 212.127.136.5; eth0; 46 bytes; from 0000b4853cbe to ffffffffffff Thu Jun 14 07:53:58 2001; UDP; eth0; 176 bytes; from 192.168.0.2:1015 to 255.255.255.255:1015
On Wed, 13 Jun 2001, Vector wrote: > The fact that your provider is using an etire class B address space for > a single broadcast network is what should be making you nervous. In most > network architecture schemes, the ip's are divided into blocks and thus > the amount of broadcasts being received by individual hosts are greatly > reduced. I would want to see more of the dump to actually determine if > this is really a problem. ARP's are used to gain the MAC address of a > system with an IP that is on the same network as you are. With a class B > address space of potentially 65,533 hosts on the same broadcast network > you can expect to see *MANY* ARP requests! Is this AT&T, sounds like > something they would do... > > vector But should it not stop one day, or at least less requests? Running the monitor for an hour resulted in more than 3000 different hosts, growing slowly. My provider is UPC in the Netherlands, no one there has ever heard of it... Thanks, Sebastiaan > > > On Wed, 13 Jun 2001, Sebastiaan wrote: > > > On Wed, 13 Jun 2001, Angus D Madden wrote: > > > > > On Wed, Jun 13, 2001 at 12:01:23PM +0200, Sebastiaan wrote: > > > > a couple of days ago I installed a COM21 cable modem. Although I can > > > > internet without problems, the modem itself is sending me endless ARP > > > > requests, while my computer does not answer them. I analysed the data > > > > with > > > > > > I have a COM21 and I have the same problem. You'll notice that the TX > > > light on your NIC will never stop. It never used to be a major problem > > > with my ne2k-pci NIC (until the NIC got toasted for one reason or > > > another). After that I switched to a 3c905*, which seemed to work great > > > but would go dead after about 15 minutes (presumably because of the arp > > > bombardment). > > I hope it did not get toated because of the COM21: I only like fried > > chips. I have no trouble with the interface (MACE, PowerMac) and the link > > is pretty stable until now. > > > > Thanks for the info, > > Sebastiaan > > > > > > > > My solution was to reset with interface with a cron job every 15 > > > minutes. It's a total rat-fsck solution, but it works. > > > > > > > > > > > This makes me nervous. 212.127.*.* is my ISP cable modem network. What > > > > is > > > > this, can I stop it? > > > > > > > > > > I'm not sure it comes from one source. If I tcp dump I see many 'arp > > > who has xxx.xxx.xxx.xxx tell xxx.xxx.xxx.xxx' and the ip addresses jump > > > around all over the place. Not sure how to stop it. > > > > > > g > > > > > > > > > > > > >
