Routing by proxyarp maybe?
mps
> On May 29, 2021, at 5:39 AM, Ian! D. Allen wrote:
>
> I used tcpdump to capture a minute of ARP traffic on my Distributel/Rogers
> cable modem interface:
>
># tcpdump -nelvvs -i eth2 arp >distributel_arp.txt
># wc distributel_arp.txt
>8511 187220 1538942 distributel_arp.txt
>
> It recorded 8,511 packets - 141 ARP packets per second!
>
> Sample:
>
> 14:13:00.519062 00:17:10:93:5d:91 > ff:ff:ff:ff:ff:ff, ethertype ARP
> (0x0806), length 60: Ethernet (len 6), IPv4 (len 4), Request who-has
> 174.116.5.41 tell 174.116.4.1, length 46
>
> Some statistics on that one minute:
>
> $ grep -P -o 'tell \K[^ ,]*' distributel_arp.txt | sort | uniq -c | sort -n
> | nl | tail
>98 276 45.2.46.129
>99 295 104.234.93.1
> 100 304 97.108.196.1
> 101 354 174.116.20.1
> 102 648 174.116.24.1
> 103 691 174.116.22.1
> 104 768 174.116.4.1
> 105 798 174.116.26.1
> 106 961 174.116.6.1
> 107 1024 174.116.8.1
>
>
> $ grep -P -o 'who-has \K[^ ]*' distributel_arp.txt | sort | uniq -c | sort
> -n | nl | tail
> 29039 174.116.5.50
> 29049 174.116.6.22
> 29059 174.116.7.21
> 29069 174.116.8.204
> 2907 10 72.141.52.157
> 2908 11 174.116.8.165
> 2909 11 174.116.8.234
> 2910 13 174.116.6.218
> 2911 16 174.116.22.127
> 2912 16 24.52.219.121
>
> I presume anyone else with a cable modem sees the same thing?
>
> --
> | Ian! D. Allen, BA, MMath - idal...@idallen.ca - Ottawa, Ontario, Canada
> | Home: www.idallen.com Contact Improvisation Dance: www.contactimprov.ca
> | Former college professor (Free/Libre GNU+Linux) at: teaching.idallen.com
> | Defend digital freedom: http://eff.org/ and have fun: http://fools.ca/
>
> To unsubscribe send a blank message to linux+unsubscr...@linux-ottawa.org
> To get help send a blank message to linux+h...@linux-ottawa.org
> To visit the archives: https://lists.linux-ottawa.org
>
To unsubscribe send a blank message to linux+unsubscr...@linux-ottawa.org
To get help send a blank message to linux+h...@linux-ottawa.org
To visit the archives: https://lists.linux-ottawa.org
