Anno domini 2019 Sat, 12 Oct 16:09:47 +0200 Stefan Krusche scripsit: > Good day everyone, > > since recently I noticed a very constant outgoing ARP traffic > on my machine (desktop, Devuan ascii) of about 7K/s which I > don't think was there before. > > jnettop shows this: > LOCAL <-> REMOTE TXBPS RXBPS > TOTALBPS > (IP) PORT PROTO (IP) PORT TX RX > TOTAL > UNKNOWNv4 <-> UNKNOWNv4 8.12K/s 0b/s > 8.12K/s > 0.0.0.0 0 ARP 0.0.0.0 0 149K 0b > 149K > > > arp cache shows this which is the standard gateway of my ISP: > $ arp -n > Address HWtype HWaddress Flags Mask > Iface > 91.65.138.254 ether 00:17:10:9a:24:a8 C > net0 > > > What can I do to further investigate where this comes from > or how to stop it? Please advise or explain to a total network > novice.
Install wireshark or tcpdump. Guess it's the "arp-who-has ... tell ..." class of messages. Nik > > Thanks and kind regards, > Stefan > _______________________________________________ > Dng mailing list > Dng@lists.dyne.org > https://mailinglists.dyne.org/cgi-bin/mailman/listinfo/dng > -- Please do not email me anything that you are not comfortable also sharing with the NSA, CIA ... _______________________________________________ Dng mailing list Dng@lists.dyne.org https://mailinglists.dyne.org/cgi-bin/mailman/listinfo/dng
