The arp's are for local resolution on my 192.168.x.x network. This FQDN
that is appearing is on another network and on my ARIN addresses.
When an arp is sent out for say, the mac address of 192.168.1.100, the
packets has an known IP address field (192.168.1.100) and an unknown
destination Mac address field (0.0.0.0), it is here that I see the fqdn
"monitoring.centuryc.net" which is on a 216.30.172.x network. All of my
arp request packets show this in them for some reason. 192.168.1.100 is
actually a windows wrkst on my local lan.
Make sense???
On Sat, 2003-02-08 at 10:56, Guy Harris wrote:
> On Fri, Feb 07, 2003 at 07:10:57PM -1000, John Covey wrote:
> > Was wondering why ethereal shows a FQDN in my arp packets. This FDQN
> > shows up in parentheses beside the destination mac address field of the
> > packet.
>
> Probably because it was either able to resolve the IP address in that
> ARP packet corresponding to that MAC address or it saw, in the capture,
> a DNS packet giving the name for that IP address.
>
> > These arp requests show that they are for hosts on the local
> > subnet looking for an unknown mac (of course) and this mysterious FDQN
> > is on another network elsewhere in my infrastructure. This shows up in
> > all arp requests.
>
> Did the MAC address in the ARP packet have an IP address going along
> with it - e.g., was it an ARP reply giving the MAC address for that IP
> address? Is the FQDN the name for that IP address (or *a* name for that
> IP address)?
> _______________________________________________
> Ethereal-users mailing list
> Ethereal-users@xxxxxxxxxxxx
> http://www.ethereal.com/mailman/listinfo/ethereal-users