Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have been experiencing very slow upload speeds on my cable network lately. I ran a tcpdump and found many ARP requests. I'm not sure what process they are coming from, but could this be related to the slow upload speeds, and do these look "normal" for typical cable connection (where I'm the only user connected currently)?

Thanks!

listening on en0, link-type EN10MB (Ethernet), capture size 65535 bytes
12:49:04.002684 ARP, Request who-has 68-118-243-118.dhcp.oxfr.ma.charter.com tell 68-118-240-1.dhcp.oxfr.ma.charter.com, length 46
12:49:04.171720 ARP, Request who-has 68-118-253-79.dhcp.oxfr.ma.charter.com tell 68-118-240-1.dhcp.oxfr.ma.charter.com, length 46
12:49:04.291645 ARP, Request who-has 68-114-89-108.static.oxfr.ma.charter.com tell 68-114-89-1.static.oxfr.ma.charter.com, length 46
12:49:04.502923 ARP, Request who-has 68-118-251-131.dhcp.oxfr.ma.charter.com tell 68-118-240-1.dhcp.oxfr.ma.charter.com, length 46
12:49:04.741602 ARP, Request who-has 68-191-76-23.dhcp.oxfr.ma.charter.com tell 68-191-76-1.dhcp.oxfr.ma.charter.com, length 46
12:49:04.911616 ARP, Request who-has 66-189-59-193.dhcp.oxfr.ma.charter.com tell 66-189-56-1.dhcp.oxfr.ma.charter.com, length 46
12:49:04.922207 IP 68-118-240-1.dhcp.oxfr.ma.charter.com.bootps > broadcasthost.bootpc: BOOTP/DHCP, Reply, length 302
12:49:04.972062 ARP, Request who-has 66-189-58-93.dhcp.oxfr.ma.charter.com tell 66-189-56-1.dhcp.oxfr.ma.charter.com, length 46
12:49:04.988999 IP 66-189-7-87.dhcp.oxfr.ma.charter.com.65456 > vip01oxfrma.oxfr.ma.charter.com.domain: 30885+ PTR? 118.243.118.68.in-addr.arpa. (45)
12:49:05.015549 IP vip01oxfrma.oxfr.ma.charter.com.domain > 66-189-7-87.dhcp.oxfr.ma.charter.com.65456: 30885 1/4/4 PTR 68-118-243-118.dhcp.oxfr.ma.charter.com. (234)
12:49:05.017837 IP 66-189-7-87.dhcp.oxfr.ma.charter.com.54271 > vip01oxfrma.oxfr.ma.charter.com.domain: 19969+ PTR? 108.89.114.68.in-addr.arpa. (44)
12:49:05.041656 ARP, Request who-has 68-118-247-67.dhcp.oxfr.ma.charter.com tell 68-118-240-1.dhcp.oxfr.ma.charter.com, length 46
12:49:05.049876 IP vip01oxfrma.oxfr.ma.charter.com.domain > 66-189-7-87.dhcp.oxfr.ma.charter.com.54271: 19969 1/4/4 PTR 68-114-89-108.static.oxfr.ma.charter.com. (234)
12:49:05.051739 IP 66-189-7-87.dhcp.oxfr.ma.charter.com.63229 > vip01oxfrma.oxfr.ma.charter.com.domain: 20205+ PTR? 131.251.118.68.in-addr.arpa. (45)
12:49:05.079028 IP vip01oxfrma.oxfr.ma.charter.com.domain > 66-189-7-87.dhcp.oxfr.ma.charter.com.63229: 20205 1/4/4 PTR 68-118-251-131.dhcp.oxfr.ma.charter.com. (234)
12:49:05.081525 IP 66-189-7-87.dhcp.oxfr.ma.charter.com.50529 > vip01oxfrma.oxfr.ma.charter.com.domain: 6279+ PTR? 193.59.189.66.in-addr.arpa. (44)
12:49:05.108656 IP vip01oxfrma.oxfr.ma.charter.com.domain > 66-189-7-87.dhcp.oxfr.ma.charter.com.50529: 6279 1/4/4 PTR 66-189-59-193.dhcp.oxfr.ma.charter.com. (232)
12:49:05.111850 IP 66-189-7-87.dhcp.oxfr.ma.charter.com.62520 > vip01oxfrma.oxfr.ma.charter.com.domain: 6811+ PTR? 93.58.189.66.in-addr.arpa. (43)
12:49:05.121518 ARP, Request who-has 68-118-252-16.dhcp.oxfr.ma.charter.com tell 68-118-240-1.dhcp.oxfr.ma.charter.com, length 46
12:49:05.173916 IP vip01oxfrma.oxfr.ma.charter.com.domain > 66-189-7-87.dhcp.oxfr.ma.charter.com.62520: 6811 1/4/4 PTR 66-189-58-93.dhcp.oxfr.ma.charter.com. (230)
12:49:05.201511 ARP, Request who-has 68-118-251-2.dhcp.oxfr.ma.charter.com tell 68-118-240-1.dhcp.oxfr.ma.charter.com, length 46
12:49:05.291734 ARP, Request who-has 68-114-83-97.dhcp.oxfr.ma.charter.com tell 68-114-83-1.dhcp.oxfr.ma.charter.com, length 46
12:49:05.542707 ARP, Request who-has 68-118-251-133.dhcp.oxfr.ma.charter.com tell 68-118-240-1.dhcp.oxfr.ma.charter.com, length 46
12:49:05.642470 ARP, Request who-has 68-112-226-74.static.oxfr.ma.charter.com tell 68-112-226-65.static.oxfr.ma.charter.com, length 46
12:49:05.677856 ARP, Request who-has 68-191-78-74.dhcp.oxfr.ma.charter.com tell 68-191-76-1.dhcp.oxfr.ma.charter.com, length 46
12:49:05.711651 ARP, Request who-has 68-114-83-87.dhcp.oxfr.ma.charter.com tell 68-114-83-1.dhcp.oxfr.ma.charter.com, length 46
12:49:05.831579 ARP, Request who-has 68-118-252-141.dhcp.oxfr.ma.charter.com tell 68-118-240-1.dhcp.oxfr.ma.charter.com, length 46
12:49:05.865214 ARP, Request who-has 68-114-83-79.dhcp.oxfr.ma.charter.com tell 68-114-83-1.dhcp.oxfr.ma.charter.com, length 46
12:49:05.891413 ARP, Request who-has 66-189-58-111.dhcp.oxfr.ma.charter.com tell 66-189-56-1.dhcp.oxfr.ma.charter.com, length 46
12:49:05.962120 ARP, Request who-has 68-118-249-42.dhcp.oxfr.ma.charter.com tell 68-118-240-1.dhcp.oxfr.ma.charter.com, length 46
12:49:05.982966 ARP, Request who-has 68-118-244-10.dhcp.oxfr.ma.charter.com tell 68-118-240-1.dhcp.oxfr.ma.charter.com, length 46
12:49:06.081588 ARP, Request who-has 68-118-247-67.dhcp.oxfr.ma.charter.com tell 68-118-240-1.dhcp.oxfr.ma.charter.com, length 46
12:49:06.182009 IP 66-189-7-87.dhcp.oxfr.ma.charter.com.62503 > vip01oxfrma.oxfr.ma.charter.com.domain: 4739+ PTR? 74.226.112.68.in-addr.arpa. (44)
12:49:06.191522 ARP, Request who-has 68-118-249-113.dhcp.oxfr.ma.charter.com tell 68-118-240-1.dhcp.oxfr.ma.charter.com, length 46
12:49:06.207321 IP vip01oxfrma.oxfr.ma.charter.com.domain > 66-189-7-87.dhcp.oxfr.ma.charter.com.62503: 4739 1/4/4 PTR 68-112-226-74.static.oxfr.ma.charter.com. (234)
12:49:06.211399 IP 66-189-7-87.dhcp.oxfr.ma.charter.com.60872 > vip01oxfrma.oxfr.ma.charter.com.domain: 59078+ PTR? 141.252.118.68.in-addr.arpa. (45)
12:49:06.222200 ARP, Request who-has 68-118-252-1.dhcp.oxfr.ma.charter.com tell 68-118-240-1.dhcp.oxfr.ma.charter.com, length 46
12:49:06.239417 IP vip01oxfrma.oxfr.ma.charter.com.domain > 66-189-7-87.dhcp.oxfr.ma.charter.com.60872: 59078 1/4/4 PTR 68-118-252-141.dhcp.oxfr.ma.charter.com. (234)
12:49:06.240915 IP 66-189-7-87.dhcp.oxfr.ma.charter.com.60890 > vip01oxfrma.oxfr.ma.charter.com.domain: 28037+ PTR? 79.83.114.68.in-addr.arpa. (43)
12:49:06.255483 ARP, Request who-has 66-189-4-153.dhcp.oxfr.ma.charter.com tell 66-189-4-1.dhcp.oxfr.ma.charter.com, length 46
12:49:06.262555 ARP, Request who-has 68-118-248-106.dhcp.oxfr.ma.charter.com tell 68-118-240-1.dhcp.oxfr.ma.charter.com, length 46
12:49:06.266299 IP vip01oxfrma.oxfr.ma.charter.com.domain > 66-189-7-87.dhcp.oxfr.ma.charter.com.60890: 28037 1/4/4 PTR 68-114-83-79.dhcp.oxfr.ma.charter.com. (230)
12:49:06.267768 IP 66-189-7-87.dhcp.oxfr.ma.charter.com.61212 > vip01oxfrma.oxfr.ma.charter.com.domain: 106+ PTR? 111.58.189.66.in-addr.arpa. (44)
12:49:06.292326 IP vip01oxfrma.oxfr.ma.charter.com.domain > 66-189-7-87.dhcp.oxfr.ma.charter.com.61212: 106 1/4/4 PTR 66-189-58-111.dhcp.oxfr.ma.charter.com. (232)
12:49:06.293768 IP 66-189-7-87.dhcp.oxfr.ma.charter.com.56911 > vip01oxfrma.oxfr.ma.charter.com.domain: 13472+ PTR? 42.249.118.68.in-addr.arpa. (44)
12:49:06.302025 ARP, Request who-has 68-118-246-46.dhcp.oxfr.ma.charter.com tell 68-118-240-1.dhcp.oxfr.ma.charter.com, length 46
12:49:06.325283 IP vip01oxfrma.oxfr.ma.charter.com.domain > 66-189-7-87.dhcp.oxfr.ma.charter.com.56911: 13472 1/4/4 PTR 68-118-249-42.dhcp.oxfr.ma.charter.com. (232)
12:49:06.614851 IP sjc-not9.sjc.dropbox.com.http > 66-189-7-87.dhcp.oxfr.ma.charter.com.51878: Flags [P.], seq 957278744:957278923, ack 4016371518, win 501, options [nop,nop,TS val 190644564 ecr 789980198], length 179
12:49:06.614951 IP 66-189-7-87.dhcp.oxfr.ma.charter.com.51878 > sjc-not9.sjc.dropbox.com.http: Flags [.], ack 179, win 65535, options [nop,nop,TS val 789980757 ecr 190644564], length 0
12:49:06.618585 IP 66-189-7-87.dhcp.oxfr.ma.charter.com.51878 > sjc-not9.sjc.dropbox.com.http: Flags [P.], seq 1:237, ack 179, win 65535, options [nop,nop,TS val 789980757 ecr 190644564], length 236
12:49:06.719929 IP sjc-not9.sjc.dropbox.com.http > 66-189-7-87.dhcp.oxfr.ma.charter.com.51878: Flags [.], ack 237, win 501, options [nop,nop,TS val 190644575 ecr 789980757], length 0
12:49:06.742127 ARP, Request who-has 68-118-245-163.dhcp.oxfr.ma.charter.com tell 68-118-240-1.dhcp.oxfr.ma.charter.com, length 46
12:49:06.792002 ARP, Request who-has 68-114-83-126.dhcp.oxfr.ma.charter.com tell 68-114-83-1.dhcp.oxfr.ma.charter.com, length 46
12:49:06.901770 ARP, Request who-has 68-114-89-97.static.oxfr.ma.charter.com tell 68-114-89-1.static.oxfr.ma.charter.com, length 46
12:49:06.988708 ARP, Request who-has 68-118-252-37.dhcp.oxfr.ma.charter.com tell 68-118-240-1.dhcp.oxfr.ma.charter.com, length 46
share|improve this question

1 Answer 1

up vote 1 down vote accepted

You're seeing those on your outside interface. The various gateway systems on your broadcast domain (the address in the tell _____ section of the ARP line) are sending those requests to find what MAC address has a specific IP.

While it's a little odd that they're letting you see all this traffic (and potentially maliciously respond to the ARP requests - I hope they have some additional layer of security there), 10-20 per second as you have here should have absolutely no impact on performance. Worry if it gets into the thousands.

share|improve this answer
    
Thanks for the help! –  chaimp Jan 4 '12 at 18:15
    
Is there a particular way using tcpdump to only view outgoing traffic? (if this is not trivial, I'll post a new question) –  chaimp Jan 4 '12 at 18:15
1  
@jeffp tcpdump src host 66.189.7.87 should do the trick. –  Shane Madden Jan 4 '12 at 18:26
1  
This is likely the result of network scanning. Most cable networks I've seen have huge broadcast domains with multiple IPv4 networks on the same segment. Whenever someone scans any of those networks the router sends an ARP for any address not in its table. Since this is the Internet in 2012, "whenever" translates to "constantly" so this ends up being standard background noise. As a side effect you can look for gaps in the scans (which means the router already has a valid ARP entry) to passively identify live addresses on your network. –  Gerald Combs Jan 4 '12 at 19:42
1  
In addition, if you're seeing these external ARP requests then that tells me that there's no "partition" between the external and internal network (unless you figured out how to connect your computer and run tcpdump on the outside interface) so my suggestion would be to put a firewall between the cable modems' internal interface and your network. –  joeqwerty Jan 5 '12 at 1:15

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.