3

Sometimes I dive into my network and often I see:

tcpdump -n arp

17:59:15.754508 ARP, Request who-has 192.168.1.65 tell 192.168.1.212, length 28
17:59:16.754401 ARP, Request who-has 192.168.1.65 tell 192.168.1.212, length 28
17:59:17.754449 ARP, Request who-has 192.168.1.65 tell 192.168.1.212, length 28
17:59:18.754505 ARP, Request who-has 192.168.1.65 tell 192.168.1.212, length 28
17:59:19.754435 ARP, Request who-has 192.168.1.65 tell 192.168.1.212, length 28
17:59:20.754422 ARP, Request who-has 192.168.1.65 tell 192.168.1.212, length 28

192.168.1.212 is a primary linux server:

ip addr
2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP qlen 1000
    link/ether c0:4a:00:02:78:c5 brd ff:ff:ff:ff:ff:ff
    inet 192.168.1.212/24 brd 192.168.1.255 scope global eth0
       valid_lft forever preferred_lft forever
    inet6 fe80::c24a:ff:fe02:78c5/64 scope link 
       valid_lft forever preferred_lft forever

does this behavior a problem or warning or what? 192.168.1.65 is a windows client emulated (often turned off).

Improve this question
3
  • 1
    Is it normal? Maybe. Possibly. Probably. .212 is trying to communicate with .65. Is that normal? Only you know that answer.
    – joeqwerty
    Mar 1, 2015 at 17:10
  • .212 has a dhcp server and bind
    – watchmansky
    Mar 1, 2015 at 17:11
  • 1
    One way to find out what wants to talk to .65 while turned off is to manually add arp entry for it onto .212 while tcpdump all trafic with dst host .65
    – Dan
    Mar 1, 2015 at 17:17

1 Answer 1

Reset to default
3

What you are observing is server .212 trying to communicate with / identify client .65

Probably, your DHCP server (.212) is checking if the client lease .65 is actively used/active or not.

Under most circumstances this can considered normal behavior; however, you are the only one that know if communications between .212 and .65 really are OK.

Improve this answer
2
  • thanks for reply, can I investigate?
    – watchmansky
    Mar 1, 2015 at 20:01
  • You can use tcpdump on server .212 - run "tcpdump -i any -nnn -X host 192.168.1.65" and report back the output.
    – shodanshok
    Mar 1, 2015 at 20:26

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .