At 04:37 PM 1/2/02, Jim Brown wrote: >Priscilla, > >Wouldn't proxy ARP generate an ARP request and an ARP reply if the source >and target networks were directly connected to the router?
No. Proxy ARP causes the router to generate ARP replies. It has no effect on ARP requests. ARP requests are generated by normal ARP when a node tries to find the MAC address of another station. They are generated by end stations and by the router. The router has to find the MAC address just like any other station does. He is sniffing on the broadband connection which presumably is shared by all hosts in his "area" (sometimes called a node in cable modem designs). He can see their ARPs and he can see the router's ARPs. Proxy ARP allows devices to communicate with devices on the other side of the router without having to know that the router is there. In this case, end stations send ARP requests for local and non-local devices. For non-local addresses, the router responds with its own MAC address. Priscilla >-----Original Message----- >From: Priscilla Oppenheimer [mailto:[EMAIL PROTECTED]] >Sent: Wednesday, January 02, 2002 3:54 PM >To: [EMAIL PROTECTED] >Subject: Re: Sniffing my broadband connection to my ISP ??? [7:30689] > > >Having proxy ARP enabled on the router would cause the router to send ARP >replies not requests. > >The fact that he sees ARP requests isn't surprising. He's on a shared >network. On a shared network you see all the ARP requests from your local >router to devices on your network. > >Priscilla > >At 05:24 PM 1/2/02, Erick B. wrote: > >Hi, > > > >Just to expand on this... > > > >The 224.0.0.1 multicast query you're seeing is coming > >from the cable modem I bet. I have a Surfboard 3100 > >cable modem and it sends out IGMP queries on 224.0.0.1 frequently. I'm > >not sure why the cable modem is doing multicast and haven't really > >looked into it. I think it may only be local to the LAN interface > >toward your PC but not 100% positive. You can use your web browser > >to view the log and status of the SB3100 cable modem > >by the way, you can see the IP in the sniffer trace. > > > >If the ARP requests are originating from the ISP default-gateway (first > >hop router for you) then maybe they have proxy arp enabled. > > > >The DHCP requests could be from other users on your > >segment, or maybe forwarded to a DHCP server on your > >segment from another segment. > > > >Also, since you're on a shared segment with others > >they may have set up their own networks, etc with > >their own address space, etc that you might see > >packets from. > > > >Erick > > > >--- Priscilla Oppenheimer wrote: > > > It sounds like you are sharing the broadcast domain > > > with a bunch of other > > > stations. The network is bridging on the edge. I > > > think this is normal for > > > cable modem systems. Is that what you are on? > > > > > > Priscilla > > > > > > At 12:23 PM 1/2/02, Phil Barker wrote: > > > >Hi Group, > > > > I have been sniffing my broadband connection > > > to > > > >my ISP today and have a few questions. > > > > > > > > My main gripe is that I'm being sent around > > > 100 > > > >Arp requests per minute, which obviously I cannot > > > >resolve. These ARP requests are all originating > > > from > > > >my default G/W at the ISP trying to resolve MAC > > > >addresses of various users. Can anyone confirm if > > > this > > > >is usual or unusual. I cannot see this being > > > correct > > > >since if I set my router up to be one of these IP addresses I can > > > >resolve it to my MAC address Eth 0 int' or any other mac-address > > > >for that matter. > > > > > > > > They also send me DHCP requests, IGMP > > > requests > > > >for group 224.0.0.1 (Which I wish I could join) but > > > >cannot and lots of their private address > > > information > > > >via the above mentioned ARP's. > > > > > > > > I also captured an attemt at an inbound TCP connection on a > > > >dynamic port which my router RST, thankfully. > > > > > > > > Are they wasting my B/W ? > > > > > > > >Thanx, > > > > > > > >Phil > > > > > > > > > > > > > > > > > > > > > > > >__________________________________________________ > > > >Do You Yahoo!? > > > >Everything you'll ever need on one web page > > > >from News and Sport to Email and Music Charts > > > >http://uk.my.yahoo.com > > > ________________________ > > > > > > Priscilla Oppenheimer > > > http://www.priscilla.com > >[EMAIL PROTECTED] > > > > > >__________________________________________________ > >Do You Yahoo!? > >Send your FREE holiday greetings online! http://greetings.yahoo.com >________________________ > >Priscilla Oppenheimer >http://www.priscilla.com ________________________ Priscilla Oppenheimer http://www.priscilla.com Message Posted at: http://www.groupstudy.com/form/read.php?f=7&i=30731&t=30689 -------------------------------------------------- FAQ, list archives, and subscription info: http://www.groupstudy.com/list/cisco.html Report misconduct and Nondisclosure violations to [EMAIL PROTECTED]
