anyone who saw this arp traffic?

From: Monty Ree (chulmin2_at_hotmail.com)
Date: 02/23/05

  • Next message: Randy Johnson: "RE: Help me" 
    To: security-basics@securityfocus.com
Date: Wed, 23 Feb 2005 01:40:43 +0000

    Hello, all.

    When I capture network traffic at server farm,I can see lots of arp
    broadcast like below.
    But there is no server which use 172.16.x.x ip address.
    and curiously,

    1. source ip and destination ip is same
    2. more curiously, same traffic(source mac:0:10:dc:f1:f7:64 , source
    ip:172.16.97.157) is seen at my office.
    3. I can also see this traffic(source mac:0:10:dc:f1:f7:64 , source
    ip:172.16.97.157 ) at other IDC.

    Have you ever seen this traffic?
     
    Thanks in advance.

    10:15:26.759069 0:10:dc:f1:f7:64 Broadcast arp 60: arp who-has
    172.16.97.157 (Broadcast) tell 172.16.97.157
    10:15:26.803792 0:c:76:4e:4:c8 Broadcast arp 60: arp who-has 172.16.100.103
    (Broadcast) tell 172.16.100.103
    10:15:26.955878 0:c:76:4e:4:c8 Broadcast arp 60: arp who-has 172.16.100.103
    (Broadcast) tell 172.16.100.103
    10:15:26.967737 0:10:dc:f1:f7:64 Broadcast arp 60: arp who-has
    172.16.97.157 (Broadcast) tell 172.16.97.157

    _________________________________________________________________
    고.. 감.. 도.. 사.. 랑.. 만.. 들.. 기.. MSN 러브
    http://www.msn.co.kr/love/

  • Next message: Randy Johnson: "RE: Help me"

    Relevant Pages

    • Re: W2K3 Excessive ARP Traffic
      ... ARP request don't simply run constantly. ... request going out for every remote mail server that it tries to send to. ... > My new W2K3 Enterprise Edition server seems to broadcast gratuitous ARP> packets every two seconds. ...
      (microsoft.public.windows.server.networking)
    • Re: Server name: What to enter?
      ... number you have specified in WME output properties for pull (WME can find ... LAN I.P. which is different to my outside I.P. Which is now the DynDNS ... Player and get the broadcast live. ... Let's address that first to see if a push to a server is what you need ...
      (microsoft.public.windowsmedia.encoder)
    • Re: Server name: What to enter?
      ... )I use the free DynDNS Updater from www.dyndns.com to provide a ... Player and get the broadcast live. ... than one camera/mic (I have 3 cameras that I can flip between during live ... Let's address that first to see if a push to a server is what you need to ...
      (microsoft.public.windowsmedia.encoder)
    • RE: 802.1x and PEAP
      ... Broadcast key rotation can only be done with an authentication server. ... IOS a different vendors card will not work with TKIP and MIC, ... > protected by the TLS session or a protected error ...
      (Security-Basics)
    • Re: The RMHH PodCast
      ... Persons wanting to broadcast will need to run their own server, ... SHOUTcast Source for Winamp Plug-In to send audio from Winamp to the ... and could dedicate this one to the podcast and even a full- ...
      (rec.music.hip-hop)