Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I'm using Xubuntu 12.04 and Wireshark to analyse network traffic in my ISP subnet I'm wired to. My system has the following IP configuration:

IP Address: 10.10.103.28 /24
Subnet Mask: 255.255.255.0
Default Gateway: 10.10.103.1

TCP/IP stack works properly, I have access to Internet and related services.

I'am confused, because I have figured out that my network interface (no promiscuous mode) captured several DHCP limited broadcast packages (IP destination address 255.255.255.255), which have source IP addresses contain different network parts of IP address, therefore addresses from other subnets than mine (I have subnet mask 255.255.255.0). Examples of incoming source IP addresses of DHCP limited broadcast packages:

10.10.100.1,
10.10.150.44,
192.168.0.1,
10.2.102.22
.

Yes, it's normal that I receive layer 2 or layer 3 limited broadcast packages (Destination IP = 255.255.255.255, FF-FF-FF-FF-FF-FF), but I do not know reasons, why incoming packets have layer 3 source IP addresses with different network parts, thus come from logically different subnets. I know that packets with limited broadcast IP destination addresses are not routed beyond layer 3 network segment. I.e my IP addresss is 10.10.103.28 / 24 (subnet mask with 24-ones prefix), but incoming packets have IP adresses such as 10.2.102.22, 10.10.100.1, thus they vary within first 24 bits.

Moreover, I have found that interface of my default gateway, connected to my subnet, has assigned several IP adresses, each with different network part. Thereafter, I have found that in my subnet there are a lot of ARP request with IP address from many varying subnets.

Why I receive limited broadcast packages with IP source addresses from logically other subnet or network? I quess that my ISP has deployed several different addressing schemes or IP subnets withing single physical ethernet segment? Or there are other reasons of this addressing issues? Maybe VLANs or something like this?

Please for help and explanation.

share|improve this question

closed as unclear what you're asking by TheCleaner, Ward, Falcon Momot, mdpc, Avery Payne Jan 26 at 3:44

Please clarify your specific problem or add additional details to highlight exactly what you need. As it's currently written, it’s hard to tell exactly what you're asking. See the How to Ask page for help clarifying this question.If this question can be reworded to fit the rules in the help center, please edit the question.

    
Please clarify your specific problem or add additional details to highlight exactly what you need. As it's currently written, it’s hard to tell exactly what you're asking. For more information see How do I ask a good question. -- Your question doesn't really make much sense. Perhaps a topology or diagram would help, but as it stands, I can't tell if your server is the ONLY device on the network, connected directly to your ISP, or what. There could be MANY reasons for what you are seeing depending on your topology. –  TheCleaner Jan 19 at 0:39
    
I have added additional paragraph of explanations. Please let me know whether it help you to understand my issue, or I will include some system configuration commands results and Wireshark screenshots to clarify the problem. –  sgnsajgon Jan 19 at 8:49

1 Answer 1

Broadcasts with a destination ip address of 255.255.255.255 or MAC address FF-FF-FF-FF-FF-FF will be seen by all hosts connected to the same layer 2 segment. DHCP and ARP both use these types of broadcasts. What you are seeing is perfectly normal for all hosts that are connected to the same layer 2 segment.

share|improve this answer
    
Yes, it's normal that I receive layer 2 or layer 3 limited broadcast packages (Destination IP = 255.255.255.255, FF-FF-FF-FF-FF-FF), but I do not know reasons, why incoming layer 3 addresses have different network parts, thus come from logically different subnets. I know that packets with limited broadcast destination addresses are not routed beyond layer 3 network segment. I.e my IP addresss is 10.10.103.28 / 24 (subnet mask with 24-ones prefix), but incoming packets have IP adresses such as 10.2.102.22, 10.10.100.1, thus they vary within first 24 bits. –  sgnsajgon Jan 19 at 8:34

Not the answer you're looking for? Browse other questions tagged or ask your own question.