Wireshark-users: Re: [Wireshark-users] Tons of ARP packets...?

From: Guy Harris <guy@xxxxxxxxxxxx>
Date: Wed, 11 Jul 2007 10:37:30 -0700
IchBin wrote:
The only problem I have is this just started last week. I have had this connection since sometime in April. Why would it just now start to rear it's head?

I did find out that Comcast is now updating and replacing hardware for higher speeds. At least that is what one of the technical support person told me. So their are big network changes happening. Naturally I do not remember the specific details.

Did they make any network changes last week?

I am concerned with the DNS calls to dyndns.org. Well at least the half hearted attempt. Not sure why is it appending xxz0n3dxx to the front of that URL. Same goes with xxz0n3dxx.dyndns.org.hsd1.pa.comcast.net. If I remember correctly the suffix of hsd1.pa.comcast.net is part of a real comcast DNS.

Does Comcast give the IP address assigned to your machine a DNS address in the hsdl.pa.comcast.net domain? If so, if some process is trying to look up xxz0n3dxx.dyndns.org, when the attempt to look it up fails, the resolver probably says "maybe that's a non-fully-qualified domain name" and tries to append the domain name suffix for the domain you're in.