On Dec 20, 2007 9:07 AM, ron <macroron@xxxxxxxxx> wrote: > Hello, > > My desktop computer, running fedora 8, software firewall on, selinux > on, dynamic dns, my ip adress is 98.203.6.135, > ron@xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx is connected directly to > Comcast via a cable modem. I recently changed modems due to an > electrical storm. I noticed the new modems pc activity light blinks > continuously. This did not happen with the old modem. I read an > article about tcp dump and tried # /usr/sbin/tcpdump -nS > tcpdump.log > Here is part of tcpdump.log: > <snip> > Is this normal? What does all this mean? > > -macroron- > I can see the 98.203.0.1 entries being potentially normal. Depending how they set things up, you could have an entire street or neighbourhood on a subnet. ARP requests are broadcast ARPs which would be seen by all hosts on the subnet, so normal traffic. I am at a lost for explaining the ARP requests coming from other ranges of IPs that are no doubt not in your subnet. What is your subnet mask? That would help determine what broadcast traffic you should see. Jacques B.
