Ethereal-users: Re: [Ethereal-users] arp

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

From: Gerald Combs <gerald@xxxxxxxxxxxx>
Date: Thu, 17 Feb 2005 08:40:16 -0600
Plantier, Spencer wrote:
> I just started monitoring my internet link and I seem to have a lot of
> arp requests. I have a Cisco 2500 router and about 120 devices off of
> it. In 17 minutes I have 2153 arp requests. Does that seem high?

That sounds normal for a public internet link.  The ARPs are likely due
to your network being scanned by virus- and worm-infected computers.
The ARPs themselves shouldn't be too much of a problem unless you have a
wireless bridge on the outside (the excessive broadcasts might affect
throughput).  If you want to find out what's behind the requests you
could install a honeypot like LaBrea (http://labrea.sourceforge.net/).