Warning: Function ereg() is deprecated in ..../includes/class_postbit.php(345) : eval()'d code on line 4

Warning: Function split() is deprecated in ..../includes/class_postbit.php(345) : eval()'d code on line 19

Warning: Function ereg() is deprecated in ..../includes/class_postbit.php(345) : eval()'d code on line 4

Warning: Function split() is deprecated in ..../includes/class_postbit.php(345) : eval()'d code on line 19
Tooooo many ARP packets on network
Results 1 to 2 of 2

Thread: Tooooo many ARP packets on network

  1. #1
    Associate
    Join Date
    Feb 2007
    Location
    Bangalore
    Posts
    13

    Unhappy Tooooo many ARP packets on network

    Hello,

    Not sure if i should be asking this question in here or linux-security...

    I have a strange problem in my network, ARP packets are being flooded into the network to the extent that sometimes the network chokes for a moment..as the below entries show every second there are 4ARP packets on the network and for every ARP packet there is STP(spanning tree protocol ) on the network, am using all linux machine in the office with 10.34.0.0/16 and not sure for where the 192.168.1.1 series is popping up on the network..Could somebody Pleaseeeeeeee help me resolve this issue.. Thanking you all in advance and any more info required on this please let me know.

    root@inlogin001 root]# tcpdump -i eth0 | grep who-has
    tcpdump: listening on eth0
    19:00:50.298506 arp who-has 192.168.1.1 tell 192.168.1.10
    19:00:50.848472 arp who-has ls.montalvosystems.in tell mboopathy.montalvosystems.in
    19:00:50.858471 arp who-has pixin.montalvosystems.in tell mboopathy.montalvosystems.in
    19:00:50.878470 arp who-has rdenduluri.montalvosystems.in tell ls.montalvosystems.in
    19:00:51.948404 arp who-has ls.montalvosystems.in tell kharsha.montalvosystems.in
    19:00:52.298382 arp who-has 192.168.1.1 tell 192.168.1.10
    19:00:54.298258 arp who-has 192.168.1.1 tell 192.168.1.10
    19:00:56.298135 arp who-has 192.168.1.1 tell 192.168.1.10
    19:00:58.298011 arp who-has 192.168.1.1 tell 192.168.1.10
    19:01:00.297888 arp who-has 192.168.1.1 tell 192.168.1.10
    19:01:02.297764 arp who-has 192.168.1.1 tell 192.168.1.10
    19:01:03.207708 arp who-has collector.montalvosystems.in tell mitsrv01.montalvosystems.in
    19:01:04.297640 arp who-has 192.168.1.1 tell 192.168.1.10
    19:01:06.297517 arp who-has 192.168.1.1 tell 192.168.1.10
    19:01:07.027472 arp who-has pdcin.montalvosystems.in tell RameshSubbarao.montalvosystems.in
    19:01:08.297393 arp who-has 192.168.1.1 tell 192.168.1.10

  2. #2
    Associate
    Join Date
    Feb 2007
    Location
    Bangalore
    Posts
    13

    Unhappy Arp

    This for the mirrored PIX port.....just a bit more info

    [root@snooper ~]# tethereal -i eth1
    Capturing on eth1
    0.000000 00000000.0800372592b1 -> 00000000.ffffffffffff IPX SAP General Response
    0.103702 Giga-Byt_e5:7b:fe -> Broadcast ARP Who has 192.168.1.1? Tell 192.168.1.10
    0.773880 00:1a:92:2b:70:ca -> Broadcast ARP Who has 10.34.0.1? Tell 10.34.2.124
    0.932634 FoundryN_87:9a:df -> Spanning-tree-(for-bridges)_00 STP RST. Root = 32769/00:0c:db:87:6e:10 Cost = 10000 Port = 0x802f
    1.057887 IntelCor_d5:87:09 -> Broadcast ARP Who has 10.34.2.183? Tell 10.34.0.23
    1.406644 10.34.0.53 -> 239.255.255.250 SSDP NOTIFY * HTTP/1.1
    1.422914 10.34.0.53 -> 239.255.255.250 SSDP NOTIFY * HTTP/1.1
    1.436901 10.34.0.53 -> 239.255.255.250 SSDP NOTIFY * HTTP/1.1
    1.451834 10.34.0.53 -> 239.255.255.250 SSDP NOTIFY * HTTP/1.1
    2.103475 Giga-Byt_e5:7b:fe -> Broadcast ARP Who has 192.168.1.1? Tell 192.168.1.10
    2.932935 FoundryN_87:9a:df -> Spanning-tree-(for-bridges)_00 STP RST. Root = 32769/00:0c:db:87:6e:10 Cost = 10000 Port = 0x802f
    4.103635 Giga-Byt_e5:7b:fe -> Broadcast ARP Who has 192.168.1.1? Tell 192.168.1.10
    4.932766 FoundryN_87:9a:df -> Spanning-tree-(for-bridges)_00 STP RST. Root = 32769/00:0c:db:87:6e:10 Cost = 10000 Port = 0x802f
    6.104811 Giga-Byt_e5:7b:fe -> Broadcast ARP Who has 192.168.1.1? Tell 192.168.1.10
    6.932985 FoundryN_87:9a:df -> Spanning-tree-(for-bridges)_00 STP RST. Root = 32769/00:0c:db:87:6e:10 Cost = 10000 Port = 0x802f
    8.104044 Giga-Byt_e5:7b:fe -> Broadcast ARP Who has 192.168.1.1? Tell 192.168.1.10
    8.933671 FoundryN_87:9a:df -> Spanning-tree-(for-bridges)_00 STP RST. Root = 32769/00:0c:db:87:6e:10 Cost = 10000 Port = 0x802f
    9.557296 10.34.2.219 -> 239.2.11.71 UDP Source port: filenet-pa Destination port: 8649
    10.106019 Giga-Byt_e5:7b:fe -> Broadcast ARP Who has 192.168.1.1? Tell 192.168.1.10
    10.932248 FoundryN_87:9a:df -> Spanning-tree-(for-bridges)_00 STP RST. Root = 32769/00:0c:db:87:6e:10 Cost = 10000 Port = 0x802f
    12.105756 Giga-Byt_e5:7b:fe -> Broadcast ARP Who has 192.168.1.1? Tell 192.168.1.10
    12.632525 Intel_0f:61:0d -> Broadcast ARP Who has 10.34.0.24? Tell 10.34.2.229
    12.932862 FoundryN_87:9a:df -> Spanning-tree-(for-bridges)_00 STP RST. Root = 32769/00:0c:db:87:6e:10 Cost = 10000 Port = 0x802f
    13.330512 10.34.0.54 -> 239.255.255.250 SSDP NOTIFY * HTTP/1.1
    13.344944 10.34.0.54 -> 239.255.255.250 SSDP NOTIFY * HTTP/1.1
    13.349675 10.34.0.54 -> 239.255.255.250 SSDP NOTIFY * HTTP/1.1
    13.360465 10.34.0.54 -> 239.255.255.250 SSDP NOTIFY * HTTP/1.1
    13.890095 AsustekC_dc:3d:f6 -> Broadcast ARP Who has 10.34.0.24? Tell 10.34.2.236
    14.105199 Giga-Byt_e5:7b:fe -> Broadcast ARP Who has 192.168.1.1? Tell 192.168.1.10
    14.316494 10.34.2.219 -> 239.2.11.71 UDP Source port: filenet-pa Destination port: 8649
    14.316498 10.34.2.219 -> 239.2.11.71 UDP Source port: filenet-pa Destination port: 8649
    14.316499 10.34.2.219 -> 239.2.11.71 UDP Source port: filenet-pa Destination port: 8649
    14.698209 00000000.000e7fe8a1b0 -> 00000000.ffffffffffff IPX SAP General Response
    14.932816 FoundryN_87:9a:df -> Spanning-tree-(for-bridges)_00 STP RST. Root = 32769/00:0c:db:87:6e:10 Cost = 10000 Port = 0x802f
    16.103910 Giga-Byt_e5:7b:fe -> Broadcast ARP Who has 192.168.1.1? Tell 192.168.1.10
    35 packets captured

    --Deepak

Similar Threads

  1. Network is running even if network service is off
    By achtanijeetu in forum Linux - Hardware, Networking & Security
    Replies: 1
    Last Post: 03-09-2010, 03:58 PM
  2. FC4 Network
    By jfournier in forum Linux - Hardware, Networking & Security
    Replies: 2
    Last Post: 12-12-2005, 01:28 PM
  3. Cannot see network
    By Anonymous in forum Linux - General Topics
    Replies: 0
    Last Post: 05-26-2004, 03:34 PM
  4. rh 6.2 box on nt network
    By trommaster in forum Linux - Hardware, Networking & Security
    Replies: 12
    Last Post: 07-15-2002, 09:35 PM
  5. Monitoring Network Packets
    By BDV2 in forum Linux - Software, Applications & Programming
    Replies: 7
    Last Post: 02-13-2002, 12:51 AM

Bookmarks

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •