I have a CentOS 5 system which serves as an IPSec VPN connector between my network and a couple of remote networks. Lately it is running into this problem once or twice a day where its ARP cache gets filled up.
The local network on which this guy sits is
10.51.0.0/16 and IPSec connects it to
10.54.0.0/16. It has 2 interfaces,
eth0 connected to the internet and
eth1 which is connected to the local network with ip
The ARP cache gets filled up with addresses like
10.51.119.x and it seems to methodically go on filling it up completely. I ran tcpdump while it was happening and saw ARP requests for all these non-existent addresses originating from the local ip
10.51.1.15 so it's almost like somebody is doing a network scan, but how do I figure out where it is originating? It is unlikely that it actually comes from the box itself, nobody should be running scans like that from it, but it might be coming from the IPSec networks? How do I figure out where it's coming from?
Problem solved: it was Kaspersky antivirus doing system discovery on our network.