[Dshield] strange arp requests

Moritz Gartenmeister moritz at uplink-verein.ch
Thu Mar 31 09:58:15 GMT 2005


hi all

i found some anormal arp requests. i never seen such pakets before. sender ip of the arp request is 
the broadcast adress. i don't find many pakets so it's seems, that it is not a scan.

03-11-05 13:46:34.955655  0:10:a4:90:1c:fb Broadcast  arp 255.255.255.255 who-has 172.17.7.118
03-11-05 13:56:06.271663  0:5:5d:e9:cf:32  Broadcast  arp 255.255.255.255 who-has 172.17.6.40
03-11-05 14:49:46.108777  0:8:74:4e:53:6   Broadcast  arp 255.255.255.255 who-has 172.17.6.139

has anyone a explanation for such pakets?

regards
moritz



More information about the list mailing list