[Dshield] strange arp requests

Moritz Gartenmeister moritz at uplink-verein.ch
Thu Mar 31 09:58:15 GMT 2005

hi all

i found some anormal arp requests. i never seen such pakets before. sender ip of the arp request is 
the broadcast adress. i don't find many pakets so it's seems, that it is not a scan.

03-11-05 13:46:34.955655  0:10:a4:90:1c:fb Broadcast  arp who-has
03-11-05 13:56:06.271663  0:5:5d:e9:cf:32  Broadcast  arp who-has
03-11-05 14:49:46.108777  0:8:74:4e:53:6   Broadcast  arp who-has

has anyone a explanation for such pakets?


More information about the list mailing list