RE: anyone who saw this arp traffic?

From: dissolved (dissolved_at_comcast.net)
Date: 02/25/05

  • Next message: Gideon T. Rasmussen, CISSP, CISA, CISM, CFSO, SCSA: "General security policy vs. security awareness" 
    To: "'Monty Ree'" <chulmin2@hotmail.com>
Date: Thu, 24 Feb 2005 19:40:16 -0500

    Are any secondary interfaces or sub-interfaces defined on a gateway?
    -----Original Message-----
    From: Monty Ree [mailto:chulmin2@hotmail.com]
    Sent: Tuesday, February 22, 2005 8:41 PM
    To: security-basics@securityfocus.com
    Subject: anyone who saw this arp traffic?

    Hello, all.

    When I capture network traffic at server farm,I can see lots of arp
    broadcast like below.
    But there is no server which use 172.16.x.x ip address.
    and curiously,

    1. source ip and destination ip is same
    2. more curiously, same traffic(source mac:0:10:dc:f1:f7:64 , source
    ip:172.16.97.157) is seen at my office.
    3. I can also see this traffic(source mac:0:10:dc:f1:f7:64 , source
    ip:172.16.97.157 ) at other IDC.

    Have you ever seen this traffic?
     
    Thanks in advance.

    10:15:26.759069 0:10:dc:f1:f7:64 Broadcast arp 60: arp who-has
    172.16.97.157 (Broadcast) tell 172.16.97.157
    10:15:26.803792 0:c:76:4e:4:c8 Broadcast arp 60: arp who-has 172.16.100.103
    (Broadcast) tell 172.16.100.103
    10:15:26.955878 0:c:76:4e:4:c8 Broadcast arp 60: arp who-has 172.16.100.103
    (Broadcast) tell 172.16.100.103
    10:15:26.967737 0:10:dc:f1:f7:64 Broadcast arp 60: arp who-has
    172.16.97.157 (Broadcast) tell 172.16.97.157

    _________________________________________________________________
    고.. 감.. 도.. 사.. 랑.. 만.. 들.. 기.. MSN 러브
    http://www.msn.co.kr/love/

  • Next message: Gideon T. Rasmussen, CISSP, CISA, CISM, CFSO, SCSA: "General security policy vs. security awareness"

    Relevant Pages

    • Re: Server name: What to enter?
      ... number you have specified in WME output properties for pull (WME can find ... LAN I.P. which is different to my outside I.P. Which is now the DynDNS ... Player and get the broadcast live. ... Let's address that first to see if a push to a server is what you need ...
      (microsoft.public.windowsmedia.encoder)
    • Re: Server name: What to enter?
      ... )I use the free DynDNS Updater from www.dyndns.com to provide a ... Player and get the broadcast live. ... than one camera/mic (I have 3 cameras that I can flip between during live ... Let's address that first to see if a push to a server is what you need to ...
      (microsoft.public.windowsmedia.encoder)
    • RE: 802.1x and PEAP
      ... Broadcast key rotation can only be done with an authentication server. ... IOS a different vendors card will not work with TKIP and MIC, ... > protected by the TLS session or a protected error ...
      (Security-Basics)
    • Re: The RMHH PodCast
      ... Persons wanting to broadcast will need to run their own server, ... SHOUTcast Source for Winamp Plug-In to send audio from Winamp to the ... and could dedicate this one to the podcast and even a full- ...
      (rec.music.hip-hop)
    • Re: Telnet printing
      ... I was getting clobbered by excessive broadcast ... The VPN tunnels I have set up don't pass broadcasts. ... WINS requires a server of some sorts. ... database logfile. ...
      (comp.unix.sco.misc)