Our subnet is connected with other subnets with router. Using wireshark I see some arp requests coming to ip addresses of our subnet from the router. Such as

Broadcast ARP 60 Who has Tell

Where is the router. I want to determine the source computer from other subnet, which sends this requests. How can I perform it?

UPD subnet is But if ARP never crosses broadcast domain boundaries then how computers from other networks can know destination of the packets(destination physical address) ? Is it obtained from the arp-table of the router? And why could router send arp requests, except probing addresses in the lease range to see which of them are free?

  • 1
    Your routing table tells your computer to send packages for another subnet to the router. In your subnet, ARP requests are made so that router and computer know who they are, and then the router in turn is going to do ARP requests to find out the MAC of the destination IP. Type route -n on Linux and route something like /print on windows to see it. – Halfgaar Jun 19 '12 at 7:18

The source of the request is the router; it's sending the request, not a device outside the subnet. ARP never crosses broadcast domain boundaries. is in the subnet, as far as the router is concerned, which means the subnet mask on the router is configured as /22 or larger.


Run wireshark on and you will see who is looking for it .

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.