Path: csiph.com!fu-berlin.de!uni-berlin.de!individual.net!not-for-mail
From: Andy Burns <usenet@andyburns.uk>
Newsgroups: comp.os.linux.misc
Subject: Re: Spurious ARP entries...
Date: Sat, 12 Jul 2025 12:14:12 +0100
Lines: 17
Message-ID: <mdeuc4FskgeU3@mid.individual.net>
References: <104tdg2$22i42$14@dont-email.me> <mdesfqFskgeU2@mid.individual.net> <104tetb$22i42$20@dont-email.me>
Mime-Version: 1.0
Content-Type: text/plain; charset=UTF-8; format=flowed
Content-Transfer-Encoding: 7bit
X-Trace: individual.net OJR5rLhWNugaa8EVC1QpGAJCFUN5bLltW2Z6+26M+hf1pvfrOR
Cancel-Lock: sha1:+Cf+eUFm9qklRNUnsbG1KXoPnKQ= sha256:+JqMUMXU4PO4oeGDCs0eX/dvn+iiOgPH/nfplcPfMUU=
User-Agent: Mozilla Thunderbird
Content-Language: en-GB
In-Reply-To: <104tetb$22i42$20@dont-email.me>
Xref: csiph.com comp.os.linux.misc:69522

The Natural Philosopher wrote:

> Andy Burns wrote:
>
>> Something scanning the subnet?
>
> Well clearly, but what? 

tcpdump capturing the relevant IPs, will tell you if "something" is 
looking at specific ports or random ones, netstat will help you find 
what process is doing it ...

> And why not all of it?
Maybe the process is trying to be sneaky to avoid detection, looks like 
it should have scanned at a slower rate in that case, because you 
noticed it ...