arp who-has? tell?

[John Cornelius]

ron wrote:

>Jacques B. said:
>
>  
>
>>I can see the 98.203.0.1 entries being potentially normal.  Depending
>>how they set things up, you could have an entire street or
>>neighbourhood on a subnet.  ARP requests are broadcast ARPs which
>>would be seen by all hosts on the subnet, so normal traffic.  I am at
>>a lost for explaining the ARP requests coming from other ranges of IPs
>>that are no doubt not in your subnet.  What is your subnet mask?  That
>>would help determine what broadcast traffic you should see.
>>
>>Jacques B.
>>
>>    
>>
>
>  
>
-----Snip-----

>>Finally, all interfaces will generate ARP requests because when you try to make a connection to an IP address on the same
>>subnet you don't know what its physical address is so your computer issues an ARP request of the form "who has
>>nn.nn.nn.nn". Whoever has that address responds with its physical address and then you can make your connection. All
>>ethernet communications is ultimately done between physical addresses which may explain why we go to all of this trouble.
>>    
>>
>
>  
>
>>--jc
>>    
>>
>
>Some info:
>
>$ sudo /sbin/ifconfig
>
>eth0      Link encap:Ethernet  HWaddr 00:11:D8:CF:C4:8C
>          inet addr:98.203.6.135  Bcast:255.255.255.255  Mask:255.255.248.0
>          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
>          RX packets:582667 errors:0 dropped:0 overruns:0 frame:0
>          TX packets:178013 errors:0 dropped:0 overruns:0 carrier:0
>          collisions:0 txqueuelen:1000
>          RX bytes:368010009 (350.9 MiB)  TX bytes:17358499 (16.5 MiB)
>          Interrupt:17 Base address:0x2000
>  
>
Okay, your ISP provides you with a subnet containing 8 Class C networks 
(2048 possible addresses) so the DHCP server has a lot of house keeping 
to do.

>lo        Link encap:Local Loopback
>          inet addr:127.0.0.1  Mask:255.0.0.0
>          UP LOOPBACK RUNNING  MTU:16436  Metric:1
>          RX packets:910 errors:0 dropped:0 overruns:0 frame:0
>          TX packets:910 errors:0 dropped:0 overruns:0 carrier:0
>          collisions:0 txqueuelen:0
>          RX bytes:2490948 (2.3 MiB)  TX bytes:2490948 (2.3 MiB)
>
>--
>
>As far as my default gateway I'm guessing 93.203.0.1
>  
>
No need to guess, try netstat -r to get a list of routes including the 
default route. Not that it matters.

>$ cat etc hosts:
>
># Do not remove the following line, or various programs
># that require network functionality will fail.
>127.0.0.1	localhost.localdomain	localhost	f8
>::1	localhost.localdomain	localhost	f8
>  
>
If you want to ignore all of those ARP packets run tcpdump as tcpdump 
not arp and you'll see all of the actual Internet traffic to and from 
your neighbors' homes.

>--
>
>Sorry I'm new at this.
>  
>
Aren't we all?

>Thanks for the reply. I figured it somehow is programmed into the
>cable modem and is somehow initiated by Comcast. I initially ignored
>it, but as a start in my learning about routers and networking I
>started here.  I basically see how it works now. My next project is to
>get a static ip address from DynDNS www.dyndns.com/ and then study up
>on routers. Any sugestions on hardware and software would be
>appreciated. I'd like to eventually experiment with a wireless sff
>motherboard diy router project.
>
>Thanks again.
>
>-macroron-
>  
>
--jc
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.fedoraproject.org/pipermail/users/attachments/20071220/8c8927fd/attachment-0001.html