It's due to the latest microsoft worms scanning IP's that aren't currently
in use, you'll notice that the arp requests are usually in sequential order.

The router will try a few times before giving up, and doesn't cache the response
for long.

On Sat, Sep 20, 2003 at 12:39:44PM -0500, nick phillips wrote:
> hello list,
> 
> just wondered if someone could satisfy my idle curiosity... i just
> downloaded ethereal and i've been playing around with capturing network
> traffic and looking through the results. i noticed that 99% of my
> traffic seems to be ARP requests from 65.27.80.1, with the request being
> "who has 65.xx.xx.xx?', with the address apparently cycling through all
> IP addresses under the 65 class a network. i assume this is fairly
> normal ARP procedure, but could anyone enlighten me as to exactly what's
> going on? or recommend a decent link for info? (most of the ones i've
> found seem to be more technical detail about the actual protocol, not
> how it is used..) i'm finding this network stuff fascinating and i'd
> like to try and work out what these various protocols are actually
> doing...
> 
> thanks for any info!
> 
> best,
> nick
> 
> 
> _______________________________________________
> TCLUG Mailing List - Minneapolis/St. Paul, Minnesota
> http://www.mn-linux.org tclug-list at mn-linux.org
> https://mailman.real-time.com/mailman/listinfo/tclug-list

-- 
Matthew S. Hallacy                            FUBAR, LART, BOFH Certified
http://www.poptix.net                           GPG public key 0x01938203

_______________________________________________
TCLUG Mailing List - Minneapolis/St. Paul, Minnesota
http://www.mn-linux.org tclug-list at mn-linux.org
https://mailman.real-time.com/mailman/listinfo/tclug-list