RE: anyone who saw this arp traffic?

From: Amit Ronen (amitro_at_spiderservices.com)
Date: 03/02/05

  • Next message: Mike: "RE: Open ports to establish a one-way trust" 
    Date: Wed, 2 Mar 2005 10:43:11 +0200
To: <security-basics@securityfocus.com>



    Try checking if there is a VPN device that use Virtual IP's for external VPN users - similar to Checkpoint office mode....

    -----Original Message-----
    From: Andrew Shore [mailto:andrew.shore@holistecs.com]
    Sent: ב 28 פברואר 2005 18:09
    To: dissolved; Monty Ree
    Cc: security-basics@securityfocus.com
    Subject: RE: anyone who saw this arp traffic?

    I've seen similar situations when using Virtual server technologies;

    Often "internal" logical networks will throw martens onto the physical network.

    HTH Andy

    -----Original Message-----
    From: dissolved [mailto:dissolved@comcast.net]
    Sent: 25 February 2005 00:40
    To: 'Monty Ree'
    Cc: security-basics@securityfocus.com
    Subject: RE: anyone who saw this arp traffic?


    Are any secondary interfaces or sub-interfaces defined on a gateway?
    -----Original Message-----
    From: Monty Ree [mailto:chulmin2@hotmail.com]
    Sent: Tuesday, February 22, 2005 8:41 PM
    To: security-basics@securityfocus.com
    Subject: anyone who saw this arp traffic?

    Hello, all.

    When I capture network traffic at server farm,I can see lots of arp
    broadcast like below.
    But there is no server which use 172.16.x.x ip address.
    and curiously,

    1. source ip and destination ip is same
    2. more curiously, same traffic(source mac:0:10:dc:f1:f7:64 , source
    ip:172.16.97.157) is seen at my office.
    3. I can also see this traffic(source mac:0:10:dc:f1:f7:64 , source
    ip:172.16.97.157 ) at other IDC.

    Have you ever seen this traffic?
     
    Thanks in advance.


    10:15:26.759069 0:10:dc:f1:f7:64 Broadcast arp 60: arp who-has
    172.16.97.157 (Broadcast) tell 172.16.97.157
    10:15:26.803792 0:c:76:4e:4:c8 Broadcast arp 60: arp who-has 172.16.100.103
    (Broadcast) tell 172.16.100.103
    10:15:26.955878 0:c:76:4e:4:c8 Broadcast arp 60: arp who-has 172.16.100.103
    (Broadcast) tell 172.16.100.103
    10:15:26.967737 0:10:dc:f1:f7:64 Broadcast arp 60: arp who-has
    172.16.97.157 (Broadcast) tell 172.16.97.157

    _________________________________________________________________
    고.. 감.. 도.. 사.. 랑.. 만.. 들.. 기.. MSN 러브
    http://www.msn.co.kr/love/





  • Next message: Mike: "RE: Open ports to establish a one-way trust"

    Relevant Pages

    • Re: WB, UPN networks to merge!
      ... CBS Corporation and Warner Bros. ... Entertainment Form New 5th Broadcast ... Each Company to Hold 50% Interest In The CW Television Network ... New Television Network to Utilize the Best Programming from CBS ...
      (rec.arts.tv)
    • Re: wireless router password security
      ... But please omit the step where disabling SSID broadcast. ... trying to connect to someone else's network. ... someone to connect to my wireless router. ...
      (alt.computer.security)
    • Re: Problem with ListAvailableSQLServers in vb 6
      ... UDP broadcast. ... Since this is a broadcast it normally only sees ... services should show up when no network is enabled. ... on which SQL Servers respond (Default protocol for SQL Server ...
      (microsoft.public.sqlserver.msde)
    • Re: Unsecured wireless network
      ... network to access it. ... Disable broadcast SSID feature. ... The SSID is used to assign an identifier to the wireless network ...
      (microsoft.public.security)
    • Broadcast nets fit themselves into niches
      ... Cover Story: Broadcast Goes Cable ... During a standup routine at the ABC upfront presentation last week at ... Criminal Intent to USA Network. ... After building its turnaround on female-targeted dramas like Desperate ...
      (rec.arts.tv)