> r...@localhost:~# tcpdump -pni br200 host 10.254.2.254 > tcpdump: verbose output suppressed, use -v or -vv for full protocol decode > listening on br200, link-type EN10MB (Ethernet), capture size 96 bytes > 20:05:40.718890 IP 10.254.2.1.40570 > 10.254.2.254.53: 57874+ A? google.com. > (28) > 20:05:45.718145 arp who-has 10.254.2.254 tell 10.254.2.1 > 20:05:45.718627 arp reply 10.254.2.254 is-at 00:16:3e:11:11:03 > 20:05:45.718867 IP 10.254.2.1.40570 > 10.254.2.254.53: 57874+ A? google.com. > (28) > 20:05:50.719166 IP 10.254.2.1.40570 > 10.254.2.254.53: 57874+ A? google.com. > (28) > 20:06:03.271249 IP 10.254.2.254.42132 > 239.255.255.250.1900: UDP, length > 273
239... is a multicast range (I learned the hard way last week when I bet a colleague that 224... was the only multicast range) Why does a dns query turn into a multicast something or other? No idea, sorry... -- To UNSUBSCRIBE, email to debian-user-requ...@lists.debian.org with a subject of "unsubscribe". Trouble? Contact listmas...@lists.debian.org Archive: http://lists.debian.org/6d4219cc1003251755p5977d8d0k7c10c182d35f3...@mail.gmail.com
