Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

We're seeing some suspicious network activity, and when I was trying to see if it was one particular server of ours I ran a Wireshark trace. I noted a lot of ARP packets asking who has x.x.x.x, but all being told to tell different addresses. In the past I've only seen the "tell" to be a single host - for example a DHCP server.

As you can see from the screenshot, there are only a few IP's being asked for, but the system to tell varies a lot. It's like all devices on the network are trying to find out who 10.10.0.40 (and a couple of others) is.

enter image description here

share|improve this question
    
So what's at 10.10.0.40? –  Michael Hampton Jun 4 '13 at 16:33
    
Giving away a list of MAC addresses of people's machines without asking for their permission is a felony in some countries. And it's not a good idea anyway. –  BatchyX Jun 4 '13 at 16:59
4  
@BatchyX, citation needed. If that is a felony it is a stupid one. For the most part mac addresses do not leave the local network. If I give you my mac address (00:0d:b9:24:78:f5) there is nothing particularly useful you can do with it. –  Zoredache Jun 4 '13 at 17:56
1  
@Zoredache Funny, that was my MAC too, but then I changed it back. –  Captain Giraffe Jun 4 '13 at 21:23
1  
Luck of the random draw. Pure coincidence that they look like real MACs. Doesn't matter anyway, I'm not in a territory where this matters. –  Cylindric Jun 7 '13 at 9:40

3 Answers 3

up vote 5 down vote accepted

This is normal, especially if whatever at 10.10.0.40 is turned off or disconnected. For example, if 10.10.0.40 is a DNS server and everyone is configured to use it as their primary DNS server then you will get a lot of machines asking for that address. But since it's not on, they will ask a lot and get no response.

share|improve this answer
    
Most definitely the case, as some MAC addresses do more than one query. –  BatchyX Jun 4 '13 at 17:07
1  
I just checked, and .40 belongs to a printer that hasn't been here since before I started. I guess everyone's machines still have that printer mapped, and Windows is constantly trying to find it. –  Cylindric Jun 5 '13 at 8:08

That doesn't look out of the ordinary to me, assuming that your 10.10.0.40 address belongs to a sever / printer / other shared resource and your users are on the same subnet & switch.

share|improve this answer

As suggested by Tim Brigham, this is not out of the ordinary. The devices are doing ARP requests to get the MAC address (layer 2 address) for the 10.10.0.40 address. By having the MAC address, the hosts will be able to connect to it directly, without having to include a Layer3 hop.

For example, if all hosts are on the same subnet and same switch, the machines can connect to 10.10.0.40 without going to a router first (which is necessary for connections on a different network).

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.