Hi there,

I am playing with tcpdump (learning) and noticed huge ammount of ARP trafic on my external interface but actualy non of hem originated or destined for my IP.
I am wondering why?
I am on cable connection. Am I on some kind of hub so that I can actually listen traffic around me or....??
Just to stress that my IP is not even on same subnet with any of these guys.


example
------------
15:36:13.351630 arp who-has 24.86.201.37 tell 24.86.200.1
15:36:13.351863 arp who-has 24.86.201.37 tell 24.86.200.1
15:36:13.369831 arp who-has 24.85.76.160 tell 24.85.76.1
15:36:13.370058 arp who-has 24.85.76.160 tell 24.85.76.1
15:36:13.374676 arp who-has 24.86.203.3 tell 24.86.200.1
15:36:13.374903 arp who-has 24.86.203.3 tell 24.86.200.1
15:36:13.382823 arp who-has 24.85.86.60 tell 24.85.84.1
15:36:13.383052 arp who-has 24.85.86.60 tell 24.85.84.1
15:36:13.395406 arp who-has 24.86.194.62 tell 24.86.192.1
15:36:13.395631 arp who-has 24.86.194.62 tell 24.86.192.1
15:36:13.476531 arp who-has 24.86.203.212 tell 24.86.200.1
15:36:13.476766 arp who-has 24.86.203.212 tell 24.86.200.1
15:36:13.492559 arp who-has 24.85.88.11 tell 24.85.88.1
15:36:13.492784 arp who-has 24.85.88.11 tell 24.85.88.1


Thanks!

It looks like you're picking up ARP broadcast traffic from a number of Shaw gateways. I'd ask Shaw about that if I were you - it seems unusual.

There may be a hub. There also may be incorrectly configured clients, cable modems etc. You probably need to live with it. What's more, you'll see things much more strange than this...

I'm not using a cable connection, but I could try shutting down those requests with false replies to one of your ISP's servers so they notice it

I'll try to contact my ISP...problem is on their side obviously.

Thanks for replies, guys!

They may very well tell you that this is normal behaviour. These are arp-requests, which are broadcasts. Hence, everyone on the same ethernet-subnet will receive them. One ethernet-subnet may very well host multiple ip-subnets.

If this is normal behaviour, and you are generating false replies, you may very well find out that your account will get blocked.

Groetjes,

Kees-Jan