Why does that sound like scavenging. I would venture to guess that who
ever owns the subnet is out looking for free addresses so they can be
reallocated.
Now if we really wanted to have some fun we would start a conspiracy
theory about it ;-)
The CIA is looking for unused IP addresses so they know what IP
addresses are in use.
Sam.
Matthew S. Hallacy wrote:
>It's due to the latest microsoft worms scanning IP's that aren't currently
>in use, you'll notice that the arp requests are usually in sequential order.
>
>The router will try a few times before giving up, and doesn't cache the response
>for long.
>
>On Sat, Sep 20, 2003 at 12:39:44PM -0500, nick phillips wrote:
>
>
>>hello list,
>>
>>just wondered if someone could satisfy my idle curiosity... i just
>>downloaded ethereal and i've been playing around with capturing network
>>traffic and looking through the results. i noticed that 99% of my
>>traffic seems to be ARP requests from 65.27.80.1, with the request being
>>"who has 65.xx.xx.xx?', with the address apparently cycling through all
>>IP addresses under the 65 class a network. i assume this is fairly
>>normal ARP procedure, but could anyone enlighten me as to exactly what's
>>going on? or recommend a decent link for info? (most of the ones i've
>>found seem to be more technical detail about the actual protocol, not
>>how it is used..) i'm finding this network stuff fascinating and i'd
>>like to try and work out what these various protocols are actually
>>doing...
>>
>>thanks for any info!
>>
>>best,
>>nick
>>
>>
>>_______________________________________________
>>TCLUG Mailing List - Minneapolis/St. Paul, Minnesota
>>http://www.mn-linux.org tclug-list at mn-linux.org
>>https://mailman.real-time.com/mailman/listinfo/tclug-list
>>
>>
>
>
>
_______________________________________________
TCLUG Mailing List - Minneapolis/St. Paul, Minnesota
http://www.mn-linux.org tclug-list at mn-linux.org
https://mailman.real-time.com/mailman/listinfo/tclug-list