arp who-has? tell?

Jacques B. jjrboucher at gmail.com
Thu Dec 20 14:31:45 UTC 2007


On Dec 20, 2007 9:07 AM, ron <macroron at gmail.com> wrote:
> Hello,
>
> My desktop computer, running fedora 8, software firewall on, selinux
> on, dynamic dns, my ip adress is 98.203.6.135,
> ron at c-98-203-6-135.hsd1.fl.comcast.net. is connected directly to
> Comcast via a cable modem. I recently changed modems due to an
> electrical storm. I noticed the new modems pc activity light blinks
> continuously. This did not happen with the old modem. I read an
> article about tcp dump and tried # /usr/sbin/tcpdump -nS > tcpdump.log
> Here is part of tcpdump.log:
>
<snip>
> Is this normal? What does all this mean?
>
> -macroron-
>
I can see the 98.203.0.1 entries being potentially normal.  Depending
how they set things up, you could have an entire street or
neighbourhood on a subnet.  ARP requests are broadcast ARPs which
would be seen by all hosts on the subnet, so normal traffic.  I am at
a lost for explaining the ARP requests coming from other ranges of IPs
that are no doubt not in your subnet.  What is your subnet mask?  That
would help determine what broadcast traffic you should see.

Jacques B.




More information about the fedora-list mailing list