1

I used Wireshark to capture the packets bellow:

...
350 18.942762436 d0:07:ca:0b:63:0c -> Broadcast    ARP 60 Who has 13.210.32.75?  Tell 13.210.32.78
351 18.947224197 d0:07:ca:0b:63:0c -> Broadcast    ARP 60 Who has 13.107.32.77?  Tell 13.107.32.78
...
368 19.653461468 d0:07:ca:0b:63:0c -> Broadcast    ARP 60 Who has 13.107.32.77?  Tell 13.107.32.78
369 19.654293156 d0:07:ca:0b:63:0c -> Broadcast    ARP 60 Who has 13.210.32.75?  Tell 13.210.32.78
...
376 20.357944097 d0:07:ca:0b:63:0c -> Broadcast    ARP 60 Who has 13.107.32.77?  Tell 13.107.32.78
377 20.459654012 d0:07:ca:0b:63:0c -> Broadcast    ARP 60 Who has 13.210.32.75?  Tell 13.210.32.78
...
394 21.272770682 d0:07:ca:0b:63:0c -> Broadcast    ARP 60 Who has 13.107.32.77?  Tell 13.107.32.78
395 21.273020974 13.107.32.76 -> 171.212.195.23 SSH 198 Encrypted response packet len=132
396 21.273069296 13.107.32.76 -> 171.212.195.23 SSH 198 Encrypted response packet len=132
397 21.273313686 13.107.32.76 -> 171.212.195.23 SSH 1050 Encrypted response packet len=984
398 21.277685816 13.107.32.76 -> 171.212.195.23 SSH 206 Encrypted response packet len=140
399 21.277738698 13.107.32.76 -> 171.212.195.23 SSH 354 Encrypted response packet len=288
400 21.293977041 171.212.195.23 -> 13.107.32.76 SSH 102 Encrypted request packet len=36
401 21.293998326 13.107.32.76 -> 171.212.195.23 TCP 66 ssh > 26048 [ACK] Seq=58305 Ack=73 Win=312 Len=0 TSval=1735797175 TSecr=577413136

You see, there have multi ARP requests for 13.210.32.75 and 13.107.32.77, and in the upper I also find the ARP requests for 13.210.32.74 and other IPs which are under the same VLAN.

Why there have this situation? is this normal? or is there any issue on the Layer3 ARP table? or any broadcast storm?

  • We need a little more context to give you a definitive answer. But it appears that 13.107.32.78 is not getting ARP responses. Are all the ARP requests you see from the same host? – Ron Trunk Jun 14 at 12:41
  • Also, why is that host ARPing for addresses not on its subnet? – Ron Trunk Jun 14 at 14:59
  • the vlan have several /29 IP segment. – 244boy Jun 14 at 15:06
  • From the MAC address d0:07:ca:0b:63:0c, it shows the ARP requests all from the same host. – 244boy Jun 14 at 15:36
  • what's the meaning of why is that host ARPing for addresses not on its subnet? – 244boy Jun 14 at 15:37

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.