ARP requests on my net?

[Bob Chiodini]

On Tue, 2006-04-04 at 19:13 -0500, Mike McCarty wrote:
> I've been watching my LAN using tcpdump, and noticed
> that ARP is running repeatedly on my FC2 machine, and
> wonder why.
> 
> ...
> 18:33:05.599443 arp who-has router tell 172.17.205.79
> 18:33:05.599732 arp reply router is-at 00:11:95:0b:cc:28
> ...
> 18:42:18.288434 arp who-has router tell 172.17.205.79
> 18:42:18.288741 arp reply router is-at 00:11:95:0b:cc:28
> ...
> 18:44:07.780777 arp who-has router tell 172.17.205.79
> 18:44:07.781074 arp reply router is-at 00:11:95:0b:cc:28
> ...
> 18:47:29.454130 arp who-has router tell 172.17.205.79
> 18:47:29.454434 arp reply router is-at 00:11:95:0b:cc:28
> ...
> 18:58:19.513302 arp who-has router tell 172.17.205.79
> 18:58:19.513610 arp reply router is-at 00:11:95:0b:cc:28
> ...
> 19:04:58.257698 arp who-has router tell 172.17.205.79
> 19:04:58.257988 arp reply router is-at 00:11:95:0b:cc:28
> 
> 172.17.205.79 is my FC2 machine. I have an entry in
> /etc/hosts for router, along with an entry for dslmodem.
> But dslmodem doesn't get queried. In any case, I don't
> know why it is querying my router to find its MAC
> address? Why should it care?
> 
> Mike

Something is accessing an IP address outside your subnet and needs the
router's MAC address to get there.  What's running on your FC machine
that might be going outside of your subnet?  Fetchmail, maybe.

Bob...