arp who-has? tell?

[John Cornelius]

John Summerfield wrote:

> John Cornelius wrote:
>
>> Actually, these messages are coming from the DHCP server for the 
>
>
> Not so. DCHP uses UDP ports 67 & 68. That's not what I saw.

Tis too! When the server chooses an address to issue to someone it has 
to verify that the address isn't already in use. To do that, it asks the 
network if anyone has the address (ARP) and if no one say's yes the 
address is issued.

If (as may be happening in this case) the DHCP server is also the 
segment's router then any time the router needs to send a packet to the 
segment it checks its ARP cache to see if it has a physical address for 
this IP address and if the address has been flushed from the cache it 
ARPs the network again to get an entry.

Since there wasn't any subsequent traffic between the router/server and 
the addresses that it was arping it's likely that it was just 
housekeeping by the DHCP server.

All of which is a fine point and is probably irrelevant to the original 
question which I believe was, WTF?

>
>> physical segment (not subnet) that the modem is on. It's updating its 
>
>
> That bit is correct.

But, of course it is!

--jc