We're seeing some suspicious network activity, and when I was trying to see if it was one particular server of ours I ran a Wireshark trace. I noted a lot of ARP packets asking who has x.x.x.x, but all being told to tell different addresses. In the past I've only seen the "tell" to be a single host - for example a DHCP server.

As you can see from the screenshot, there are only a few IP's being asked for, but the system to tell varies a lot. It's like all devices on the network are trying to find out who (and a couple of others) is.

enter image description here

  • So what's at – Michael Hampton Jun 4 '13 at 16:33
  • 1
    Giving away a list of MAC addresses of people's machines without asking for their permission is a felony in some countries. And it's not a good idea anyway. – BatchyX Jun 4 '13 at 16:59
  • 6
    @BatchyX, citation needed. If that is a felony it is a stupid one. For the most part mac addresses do not leave the local network. If I give you my mac address (00:0d:b9:24:78:f5) there is nothing particularly useful you can do with it. – Zoredache Jun 4 '13 at 17:56
  • 2
    @Zoredache Funny, that was my MAC too, but then I changed it back. – Captain Giraffe Jun 4 '13 at 21:23
  • 2
    Luck of the random draw. Pure coincidence that they look like real MACs. Doesn't matter anyway, I'm not in a territory where this matters. – Cylindric Jun 7 '13 at 9:40

This is normal, especially if whatever at is turned off or disconnected. For example, if is a DNS server and everyone is configured to use it as their primary DNS server then you will get a lot of machines asking for that address. But since it's not on, they will ask a lot and get no response.

  • Most definitely the case, as some MAC addresses do more than one query. – BatchyX Jun 4 '13 at 17:07
  • 4
    I just checked, and .40 belongs to a printer that hasn't been here since before I started. I guess everyone's machines still have that printer mapped, and Windows is constantly trying to find it. – Cylindric Jun 5 '13 at 8:08

That doesn't look out of the ordinary to me, assuming that your address belongs to a sever / printer / other shared resource and your users are on the same subnet & switch.


As suggested by Tim Brigham, this is not out of the ordinary. The devices are doing ARP requests to get the MAC address (layer 2 address) for the address. By having the MAC address, the hosts will be able to connect to it directly, without having to include a Layer3 hop.

For example, if all hosts are on the same subnet and same switch, the machines can connect to without going to a router first (which is necessary for connections on a different network).

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.