John Summerfield wrote: > Ed Greshko wrote: > >>> 14:48:19.063647 arp who-has 10.9.226.129 tell 70.41.148.1 >> >> The above are ARP broadcast packets. ARP stands for Address Resolution >> Protocol. >> >> It is a bit strange to see these in your network since ARP broadcast >> packets >> aren't supposed to survive past the subnet they are transmitted on. The >> purpose of the ARP request is to get the MAC address of a given IP >> address. >> Taking one line of your output above... >> >> 14:48:10.668593 arp who-has 70.41.115.191 tell 70.41.112.1 >> >> The source of the ARP message is 70.41.112.1. It is sending out a >> broadcast >> message asking "Who ever has IP address of 70.41.115.191, please respond >> with your MAC address". >> >> You aren't seeing the response...but if you had you'd see something like: >> >> 07:27:51.893480 arp reply 70.41.115.191 is-at 00:30:6e:c7:63:8f >> >> These packets are coming into your network. They are 42 bytes long. >> You'd >> have to have a whole heck of a lot of these to drive up your network >> usage. >> In any case, they are inbound and not associated with any requests from >> your side so it is unlikely that the ISP is counting these as your >> traffic. > > > I have seen this kind of thing. > > we were using a four-port ADSL switch/router. Ordinarily, one uses it to > manage the Internet connexion, and plugs up to four computers into it. > > I think what I tried to do is put it into bridging mode, attach it to > (say) eth0, run rp-ppp (or similar) on eth0 _and_ give eth0 an IP > address so it could talk to other computers on the eth0 network. > > I had a reason to run tcpdump and did not like what I saw, so I reverted > to a more conventional configuration. I've not experienced that... But come to think of it, Wild Blue is a satellite system and while it has been years since I worked on a network with satellite links I vaguely recall more bridging than routing going on.
