Path: csiph.com!v102.xanadu-bbs.net!xanadu-bbs.net!feeder.erje.net!eu.feeder.erje.net!newsfeed.fsmpi.rwth-aachen.de!newsfeed.straub-nv.de!eternal-september.org!feeder.eternal-september.org!mx02.eternal-september.org!.POSTED!not-for-mail From: Ralph Spitzner Newsgroups: comp.os.linux.networking Subject: Re: Strange ARP flood Date: Thu, 15 Jan 2015 10:12:08 +0100 Organization: Hanswurst & Kaspar Hauser Ltd. Lines: 12 Message-ID: <8sckob-vg6.ln1@spitzner.org> References: <20150113185626.69fb1a36@PC-0511-005.oficinas.atrapalo.com> Mime-Version: 1.0 Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit Injection-Info: mx02.eternal-september.org; posting-host="f765b26fea2777394750e486946877c0"; logging-data="22927"; mail-complaints-to="abuse@eternal-september.org"; posting-account="U2FsdGVkX1/4HMrd7rOfgpc1CZewFBXZBQZQwq/uwT8=" User-Agent: Mozilla/5.0 (X11; Linux i686; rv:34.0) Gecko/20100101 Firefox/34.0 SeaMonkey/2.31 In-Reply-To: <20150113185626.69fb1a36@PC-0511-005.oficinas.atrapalo.com> Cancel-Lock: sha1:oauu4MHqTEuhvhsRb+9J14B8MsM= Xref: csiph.com comp.os.linux.networking:3209 pk wrote: [....] > 18:23:44.326912 3c:15:c2:c8:cb:11 > ff:ff:ff:ff:ff:ff, ethertype ARP (0x0806), length 60: Ethernet (len 6), IPv4 (len 4), Request who-has 10.15.10.251 (ff:ff:ff:ff:ff:ff) tell 10.15.10.251, length 46 Is there ever any answer ? (10.15.10.251 is at 3c:15:c2:c8:cb:11, or the likes ?) -- Mostly harmless... -Douglas Adams