11

When i run tcpdump in the gateway, i get a lot of arp requests originating from the gateway itself. I wonder know why this happens. How can i find the process that causes these arp requests?

$ tcpdump -n arp 
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on eth0, link-type EN10MB (Ethernet), capture size 96 bytes
16:51:03.662114 ARP, Request who-has 211.123.123.251 tell 211.123.123.242, length 28
16:51:03.954113 ARP, Request who-has 211.123.123.246 tell 211.123.123.242, length 28
16:51:04.002111 ARP, Request who-has 211.123.123.254 tell 211.123.123.242, length 28
16:51:04.518111 ARP, Request who-has 211.123.123.248 tell 211.123.123.242, length 28
16:51:04.954113 ARP, Request who-has 211.123.123.246 tell 211.123.123.242, length 28
16:51:05.002110 ARP, Request who-has 211.123.123.254 tell 211.123.123.242, length 28
16:51:05.518110 ARP, Request who-has 211.123.123.248 tell 211.123.123.242, length 28
16:51:06.002112 ARP, Request who-has 211.123.123.254 tell 211.123.123.242, length 28
16:51:06.210111 ARP, Request who-has 211.123.123.252 tell 211.123.123.242, length 28
16:51:06.518114 ARP, Request who-has 211.123.123.248 tell 211.123.123.242, length 28
16:51:07.114111 ARP, Request who-has 211.123.123.246 tell 211.123.123.242, length 28
16:51:07.210111 ARP, Request who-has 211.123.123.252 tell 211.123.123.242, length 28
16:51:07.314112 ARP, Request who-has 211.123.123.249 tell 211.123.123.242, length 28

Following is the gate config:

$ ip addr
2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UNKNOWN qlen 1000
    link/ether 6c:f0:49:a8:05:4c brd ff:ff:ff:ff:ff:ff
    inet 211.123.123.242/28 brd 211.123.123.255 scope global eth0
    inet6 fe80::6ef0:49ff:fea8:54c/64 scope link 
       valid_lft forever preferred_lft forever

In this subnet, only 211.123.123.242 (the gateway ip) is available, other ips (such as 211.123.123.246) are unavailable.

Update:

I can see traffic to these unavailable ips, i think this is the reason for these arps. Although i can't figure out yet why these traffic happens. Maybe the misconfigure in the isp providers.

$ tcpdump host 211.103.252.245
23:50:11.414705 IP 59.34.131.5.7099 > 211.123.123.245.17701: Flags [S.], seq 3745049197, ack 1625918577, win 8760, options [mss 1460], length 0
23:50:12.991258 IP 75.126.1.222.80 > 211.123.123.245.1078: Flags [S.], seq 651817046, ack 152032452, win 17473, length 0
Improve this question

4 Answers 4

Reset to default
9

This behavior is very common when you have a DHCP server running. The server probes addresses in the lease range to see which of them are free. There are also other network monitoring solutions that uses ARP to track which addresses are in use on a network.

As far as I know there is no system in Unix like systems to see which program initiates an arp request. You could possibly strace/ktrace/dtrace to find the system call.

In the end I would not worry too much about it. Large amount of ARP packets can cause problems, but only when it gets into the 1000pps range. A few packets a second is nothing to worry about.

Improve this answer
1
  • Thanks, strace the process one by one is a way. I am so sorry that there is no better way.
    – Ping Yin
    May 5, 2011 at 16:12
6

ARP requests on a router is expected behaviour. ARP requests are used so the router knows the next hop address on the network for a particular route. Its basic job is to map an IP address to a MAC address.

From the sample you have provided above, it doesn't look like it is ARP'ing excessively.

Improve this answer
4

If the ARP packets originate from a Linux box you can try generating a generous amount of iptables rules with --pid-owner XXX option (matches if pid of the process creating the packet is XXX; you'd have to cover a large range of pid numbers) and hope that the process that actually sends packets isn't a short-lived spawn of something else.

Alternatively, you could use (much fewer) --uid-owner XXX options to find the uid of the owner of the process that sent the packet.

On a tangent, if 211.123.123.242 is your gateway and it looks for MAC addresses corresponding to various IPs from this network, then it may have some packets to deliver from outside the network. Who and why tries to communicate with non-existing addresses may be actually more interesting thing to investigate, than hunting for the originator of ARP requests on the gateway box.

Improve this answer
4
  • I have updated my question. You are right, there are packets from outside to the unavailable ips, although i havn't figured out the reason yet.
    – Ping Yin
    May 5, 2011 at 16:09
  • 1
    @Ping Yin Probably you are being scanned for some exploit.
    – Paweł Brodacki
    May 5, 2011 at 16:16
  • Public scanning is basically a continuous nuisance, there are so many compromised machines scanning for other machines to compromise you will see continuous ARPs for any public IP.
    – mfarver
    May 5, 2011 at 16:28
  • thanks for the hint, it may be due to the public scanning.
    – Ping Yin
    May 6, 2011 at 5:10
1

ARP requests are normal. this protocol is used to know where some machines with MAC are. then over ARP IP is build. ARP is build in kernel as ARP module. Check this and this

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .