Priscilla, Wouldn't proxy ARP generate an ARP request and an ARP reply if the source and target networks were directly connected to the router?
-----Original Message----- From: Priscilla Oppenheimer [mailto:[EMAIL PROTECTED]] Sent: Wednesday, January 02, 2002 3:54 PM To: [EMAIL PROTECTED] Subject: Re: Sniffing my broadband connection to my ISP ??? [7:30689] Having proxy ARP enabled on the router would cause the router to send ARP replies not requests. The fact that he sees ARP requests isn't surprising. He's on a shared network. On a shared network you see all the ARP requests from your local router to devices on your network. Priscilla At 05:24 PM 1/2/02, Erick B. wrote: >Hi, > >Just to expand on this... > >The 224.0.0.1 multicast query you're seeing is coming >from the cable modem I bet. I have a Surfboard 3100 >cable modem and it sends out IGMP queries on 224.0.0.1 frequently. I'm >not sure why the cable modem is doing multicast and haven't really >looked into it. I think it may only be local to the LAN interface >toward your PC but not 100% positive. You can use your web browser >to view the log and status of the SB3100 cable modem >by the way, you can see the IP in the sniffer trace. > >If the ARP requests are originating from the ISP default-gateway (first >hop router for you) then maybe they have proxy arp enabled. > >The DHCP requests could be from other users on your >segment, or maybe forwarded to a DHCP server on your >segment from another segment. > >Also, since you're on a shared segment with others >they may have set up their own networks, etc with >their own address space, etc that you might see >packets from. > >Erick > >--- Priscilla Oppenheimer wrote: > > It sounds like you are sharing the broadcast domain > > with a bunch of other > > stations. The network is bridging on the edge. I > > think this is normal for > > cable modem systems. Is that what you are on? > > > > Priscilla > > > > At 12:23 PM 1/2/02, Phil Barker wrote: > > >Hi Group, > > > I have been sniffing my broadband connection > > to > > >my ISP today and have a few questions. > > > > > > My main gripe is that I'm being sent around > > 100 > > >Arp requests per minute, which obviously I cannot > > >resolve. These ARP requests are all originating > > from > > >my default G/W at the ISP trying to resolve MAC > > >addresses of various users. Can anyone confirm if > > this > > >is usual or unusual. I cannot see this being > > correct > > >since if I set my router up to be one of these IP addresses I can > > >resolve it to my MAC address Eth 0 int' or any other mac-address > > >for that matter. > > > > > > They also send me DHCP requests, IGMP > > requests > > >for group 224.0.0.1 (Which I wish I could join) but > > >cannot and lots of their private address > > information > > >via the above mentioned ARP's. > > > > > > I also captured an attemt at an inbound TCP connection on a > > >dynamic port which my router RST, thankfully. > > > > > > Are they wasting my B/W ? > > > > > >Thanx, > > > > > >Phil > > > > > > > > > > > > > > > > > >__________________________________________________ > > >Do You Yahoo!? > > >Everything you'll ever need on one web page > > >from News and Sport to Email and Music Charts > > >http://uk.my.yahoo.com > > ________________________ > > > > Priscilla Oppenheimer > > http://www.priscilla.com >[EMAIL PROTECTED] > > >__________________________________________________ >Do You Yahoo!? >Send your FREE holiday greetings online! http://greetings.yahoo.com ________________________ Priscilla Oppenheimer http://www.priscilla.com Message Posted at: http://www.groupstudy.com/form/read.php?f=7&i=30722&t=30689 -------------------------------------------------- FAQ, list archives, and subscription info: http://www.groupstudy.com/list/cisco.html Report misconduct and Nondisclosure violations to [EMAIL PROTECTED]
