I'm using Xubuntu 12.04 and Wireshark to analyse network traffic in my ISP subnet I'm wired to. My system has the following IP configuration:
IP Address: 10.10.103.28 /24
Subnet Mask: 255.255.255.0
Default Gateway: 10.10.103.1
TCP/IP stack works properly, I have access to Internet and related services.
I'am confused, because I have figured out that my network interface (no promiscuous mode) captured several DHCP limited broadcast packages (IP destination address 255.255.255.255), which have source IP addresses contain different network parts of IP address, therefore addresses from other subnets than mine (I have subnet mask 255.255.255.0). Examples of incoming source IP addresses of DHCP limited broadcast packages:
Yes, it's normal that I receive layer 2 or layer 3 limited broadcast packages (Destination IP = 255.255.255.255, FF-FF-FF-FF-FF-FF), but I do not know reasons, why incoming packets have layer 3 source IP addresses with different network parts, thus come from logically different subnets. I know that packets with limited broadcast IP destination addresses are not routed beyond layer 3 network segment. I.e my IP addresss is 10.10.103.28 / 24 (subnet mask with 24-ones prefix), but incoming packets have IP adresses such as 10.2.102.22, 10.10.100.1, thus they vary within first 24 bits.
Moreover, I have found that interface of my default gateway, connected to my subnet, has assigned several IP adresses, each with different network part. Thereafter, I have found that in my subnet there are a lot of ARP request with IP address from many varying subnets.
Why I receive limited broadcast packages with IP source addresses from logically other subnet or network? I quess that my ISP has deployed several different addressing schemes or IP subnets withing single physical ethernet segment? Or there are other reasons of this addressing issues? Maybe VLANs or something like this?
Please for help and explanation.