I have a CentOS 5 system which serves as an IPSec VPN connector between my network and a couple of remote networks. Lately it is running into this problem once or twice a day where its ARP cache gets filled up.
The local network on which this guy sits is 10.51.0.0/16
and IPSec connects it to 10.53.0.0/16
and 10.54.0.0/16
. It has 2 interfaces, eth0
connected to the internet and eth1
which is connected to the local network with ip 10.51.1.15
.
The ARP cache gets filled up with addresses like 10.51.119.x
and it seems to methodically go on filling it up completely. I ran tcpdump while it was happening and saw ARP requests for all these non-existent addresses originating from the local ip 10.51.1.15
so it's almost like somebody is doing a network scan, but how do I figure out where it is originating? It is unlikely that it actually comes from the box itself, nobody should be running scans like that from it, but it might be coming from the IPSec networks? How do I figure out where it's coming from?
Problem solved: it was Kaspersky antivirus doing system discovery on our network.