ARP Scans

From: ch ganser (chganser_at_gmx.net)
Date: 12/24/03

Next message: Vincent Kergonna: "Re: Wireless problems with Lucent Tech card"
Previous message: ian: "Thanks"
Next in thread: Michael Heiming: "Re: ARP Scans"
Reply: Michael Heiming: "Re: ARP Scans"
Reply: Neil Horman: "Re: ARP Scans"
Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

Date: Wed, 24 Dec 2003 12:39:18 +0100

In our network, some hosts behave quite strange:
They produce between 1000-30000 arp "who-has" packages per day. our
gateway and dns-server have only around 500.

is there an other explaination than an arp scan (any normal application)?

thanks

chganser

Next message: Vincent Kergonna: "Re: Wireless problems with Lucent Tech card"
Previous message: ian: "Thanks"
Next in thread: Michael Heiming: "Re: ARP Scans"
Reply: Michael Heiming: "Re: ARP Scans"
Reply: Neil Horman: "Re: ARP Scans"
Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

Relevant Pages

Re: Routing and ARP Problem - HELP
... > My Problem was, that eth0 had answered to any ARP Request, which was ... way since we are in same subnet and i can only set one default gateway ... There is no problem with having multiple ...
(comp.os.linux.networking)
Re: Query regarding subnetting
... > let the subnet of the host be as follows 255.255.255.192 and gateway ... The router needs to know what IPs to accept from its LAN, ... Whether an IP is sent to a router or directly (arp) depends upon whether ... broadcast address to find other machines and negotiate master browser. ...
(comp.os.linux.networking)
Re: Solution to ARP spoofing on 3560 and 2960 switches please
... the buildings have their own VLAN/subnets. ... strange ARP packets and announcing themselves as the gateway of the ... instead of using the real gateway ... Although I haven't confirmed it, I suspect the infected system will send the ARP packets with its own MAC address in the frame, and only alter the "Sender MAC Address" in the ARP header. ...
(comp.dcom.sys.cisco)
Re: Solution to ARP spoofing on 3560 and 2960 switches please
... all the infections 7/24. ... the buildings have their own VLAN/subnets. ... strange ARP packets and announcing themselves as the gateway of the ... instead of using the real gateway ...
(comp.dcom.sys.cisco)
Re: Solution to ARP spoofing on 3560 and 2960 switches please
... the buildings have their own VLAN/subnets. ... strange ARP packets and announcing themselves as the gateway of the ... instead of using the real gateway ... As a solution DHCP spoofing (Dynamic ARP Inspection.) is recommended ...
(comp.dcom.sys.cisco)