On Tue, 2006-04-04 at 19:13 -0500, Mike McCarty wrote:
I've been watching my LAN using tcpdump, and noticed
that ARP is running repeatedly on my FC2 machine, and
wonder why.
...
18:33:05.599443 arp who-has router tell 172.17.205.79
18:33:05.599732 arp reply router is-at 00:11:95:0b:cc:28
...
18:42:18.288434 arp who-has router tell 172.17.205.79
18:42:18.288741 arp reply router is-at 00:11:95:0b:cc:28
...
18:44:07.780777 arp who-has router tell 172.17.205.79
18:44:07.781074 arp reply router is-at 00:11:95:0b:cc:28
...
18:47:29.454130 arp who-has router tell 172.17.205.79
18:47:29.454434 arp reply router is-at 00:11:95:0b:cc:28
...
18:58:19.513302 arp who-has router tell 172.17.205.79
18:58:19.513610 arp reply router is-at 00:11:95:0b:cc:28
...
19:04:58.257698 arp who-has router tell 172.17.205.79
19:04:58.257988 arp reply router is-at 00:11:95:0b:cc:28
172.17.205.79 is my FC2 machine. I have an entry in
/etc/hosts for router, along with an entry for dslmodem.
But dslmodem doesn't get queried. In any case, I don't
know why it is querying my router to find its MAC
address? Why should it care?
You almost had me for a moment.
I always use the "-n" flag so I could not figure out what
"router", was supposed to be. ARP does not use hostnames
but tcpdump will resolve the host name for you.
I am going to guess that "host router" will give you the IP
address that 172.17.205.79 is looking for.
To get a clearer idea of what is going on use :
/usr/sbin/tcpdump -nvv host 172.17.205.79
This will give some verbose information about what
172.17.205.79 is doing, and it will NOT resolve host names
which can make things clearer.