ARP requests on my net?

[Ed Greshko]

Mike McCarty wrote:
> I've been watching my LAN using tcpdump, and noticed
> that ARP is running repeatedly on my FC2 machine, and
> wonder why.
> 
> ...
> 18:33:05.599443 arp who-has router tell 172.17.205.79
> 18:33:05.599732 arp reply router is-at 00:11:95:0b:cc:28
> ...

> 172.17.205.79 is my FC2 machine. I have an entry in
> /etc/hosts for router, along with an entry for dslmodem.
> But dslmodem doesn't get queried. In any case, I don't
> know why it is querying my router to find its MAC
> address? Why should it care?

When asking questions such as these you should use IP addresses and not
names.  It is less confusing to others and eliminates guesswork.  Use -n
in tcpdump.

In your hosts file, what is the IP address for "router" and
dslmodem"?  Also, what is the IP address of your default route?

I believe you will find that your FC2 machine is simply making a query
for the MAC address of the system/device defined as the default route.
Very normal.


-- 
phosflink:
	To flick a bulb on and off when it burns out (as if, somehow, that
	will bring it back to life).
		-- "Sniglets", Rich Hall & Friends