0

I need help understanding an ARP Storm PCAP I'm currently studying. My understating is that routers will strip layer 2 info. Therefore, an ARP request frame will not go through a layer 3 device (Broadcast Domain). However, in the storm PCAP I see ARP requests from 8 different networks. Assuming that the computer running Wireshark has an IP address from one of those networks, it does not explain how the other IPs are sending ARP requests.

enter image description here

One solution that someone mentioned is that: The ARP request are NOT coming from external networks. Instead, the ARP requests are coming from workstations on the network trying to reach external websites so they'll send a broadcast out to the entire network looking for the MAC. They attempt to resolve public IP addresses, but it never occurs in this instance.

However, if this is the case, how come when I run Wireshark on my laptop and visit websites I never visited before, I do not see an ARP request? Or from any of my other devices doing the same thing (i.e. visiting websites never visited before). Is there a way to recreate this in a smaller scale?

Thank you in advance!

closed as off-topic by Ron Maupin Oct 22 '18 at 18:24

This question appears to be off-topic. The users who voted to close gave this specific reason:

  • "NE is a site for to ask and provide answers about professionally managed networks in a business environment. Your question falls outside the areas our community decided are on topic. Please visit the help center for more details. If you disagree with this closure, please ask on Network Engineering Meta." – Ron Maupin
If this question can be reworded to fit the rules in the help center, please edit the question.

  • 1
    It looks like you have serious configuration problems on the network devices. Please edit your question to include a good network description or diagram, the network device models, and the network device descriptions. You can use the Network Engineering Question Checklist for guidance. We cannot guess or speculate what the problem is. – Ron Maupin Oct 22 '18 at 17:44
  • @RonMaupin, thanks for your comment. And you're right, I should've been more clear. I'm currently taking a intrusion detection class and this is a Wireshark capture that the instructor provided to the class. We need to answer a few questions regarding the capture, including what's happening in the capture. I think what I'm trying to figure out is based on what we see in the PCAP: is this an ARP storm from devices in the local network trying to resolve public IPs and therefore generating an ARP storm or are the ARP requests coming from multiple networks (from all the public IPs)? Thanks! – netavaster Oct 22 '18 at 18:21
  • 1
    Unfortunately, all "education, certification, or homework" questions are explicitly off-topic here. Your question is also really too broad to give a specific answer, and we do not have the context to correctly answer it. – Ron Maupin Oct 22 '18 at 18:24
2

All those ARP requests are coming from the same L2 source, likely a router. Using the MAC address, you should be able to locate that device easily.

You need to check out its configuration, pretty obviously the default route, an uplink route or an interface is misconfigured. Instead of sending a packet out of a WAN interface, the router attempts to contact the destination locally on your LAN interface.

Edit: those IP addresses are Roadrunner CPEs - if these ARP requests appear inside your LAN, someone might have mixed up interfaces badly.

  • My understanding is that ARP requests cannot go through a router so if these ARP requests are coming from external sources, they would get dropped as soon as they hit the first router in their network. Routers are L3 devices. – netavaster Oct 22 '18 at 18:24
  • Yes. ARP requests don't cross a router. Likely, the router tries to contact these IP addresses and its misconfiguration makes it assume these addresses are local in the segment you captured those requests on. – Zac67 Oct 22 '18 at 19:07
  • Let's assume that a workstation in the local segment is trying to reach one of those public addresses (e.g. 24.166.174.221) though a browser would that workstation generate an ARP frame that says "Who has 24.166.174.221 Tell 24.166.172.1"? When I expand on one of those frames I see: Sender MAC address: Cisco251_af:f4:54 (00:07:0d:af:f4:54) Sender IP address: 24.166.172.1 Target MAC address: 00:00:00_00:00:00 (00:00:00:00:00:00) Target IP address: 24.166.174.221 – netavaster Oct 22 '18 at 22:04

Not the answer you're looking for? Browse other questions tagged or ask your own question.