[CentOS] ARP Problem ???

[Craig Van Ham]

It's multiple IPs of clients on the network.

-----Original Message-----
From: centos-bounces at centos.org [mailto:centos-bounces at centos.org] On Behalf
Of Robert Moskowitz
Sent: Tuesday, June 12, 2007 8:19 AM
To: CentOS mailing list
Subject: Re: [CentOS] ARP Problem ???

Bob Chiodini wrote:
>
>
> Robert Moskowitz wrote:
>> Craig Van Ham wrote:
>>>
>>> Does any one know if this is normal operating of ARP. Or where to 
>>> start looking.
>>>
>>> I am seeing a lot of ARP requests for my router IP from the same IP 
>>> within seconds.
>>>
>>>
>>> 21:04:41.112929 arp who-has IP tell MY ROUTERS IP
>>>
>> Get us the MAC address that is asking. This will give us the card 
>> manufacturer, which will then, perhaps tell you which system on your 
>> network is the culprit.
>>
>> _______________________________________________
>> CentOS mailing list
>> CentOS at centos.org
>> http://lists.centos.org/mailman/listinfo/centos
> It looks like it's his router that is asking and the requested device 
> is not responding.  Is the "who-has IP" address up and valid?
It would be interesting to know what IP address is being asked for. 

For example, this is the router asking, and of course the router's 
interface is statically configured, and the address it is looking for is 
either its:

The DNS server
The NTP server
The SYSLOG server
The COPS policy server (yeah, like anyone has implemented COPS and if 
they did, this would be an anycast)


The SYSLOG server has my bet, as a router, configured for remote 
syslogging will always have something to send to its syslog...


_______________________________________________
CentOS mailing list
CentOS at centos.org
http://lists.centos.org/mailman/listinfo/centos