1

I'm trying to review a Wireshark capture and it seems the network is heavily flooded with ARP requests that make no sense to me.

  1. The destination is not "Broadcast", but some unknown DELL device (none are present on the network).
  2. The "who-has" IP is not part of the same network the pc is capturing from.
  3. The "tell" IP is not part of the same network either.

ARP requests example

Any ideas of what could be going on here?

5
  • What/where was this capture taken? – Ron Trunk Dec 14 '20 at 19:37
  • On a Desktop, connected via Ethernet. Capture has been taken with wireshark. – Guest Dec 14 '20 at 19:44
  • Trace down the source of the traffic, and check the system sending them. Looks sorta like what a load balancing device does to verify reachability. I would suspect a misconfigured thing (VM?) before "hackerz!?!" (It could also be a broken DHCP client using the wrong interface.) – Ricky Dec 14 '20 at 21:11
  • 1
    "I'm not the owner of the network" Unfortunately, questions about networks you do not directly control are off-topic here. – Ron Maupin Dec 15 '20 at 3:15
  • The destination Mac aged out of the forwarding tables of the switches between you and the sender. – user253751 Dec 15 '20 at 20:30
0

Likely, someone has connected a rogue device to your network.

You need to look for the source MAC address. If that is unknown, check the switch's MAC address table for the source port. Work your way back from there, across your switches, to the port of the source device. Disconnect or shut down the device.

8
  • 1
    The source MAC looks suspiciously fake – Ron Trunk Dec 14 '20 at 19:51
  • The thing is the IP address for the suspicious device literally ends with .230.1 whereas the IP addresses of devices connected to the network all end with .227.XXX. It doesn't look like that IP can be part of the same network. – Guest Dec 14 '20 at 19:57
  • Unless you know that IP network address it doesn't really matter. A device can send anything. You need to track the source MAC. – Zac67 Dec 14 '20 at 20:00
  • Source MAC is 00:11:22:33:44:55, which matches the router's one, but is also a commonly spoofed MAC address i guess. – Guest Dec 14 '20 at 20:02
  • Pretty weird address for a router - a manual MAC should be LAA instead of UAA... Your router might be trying to ARP that address. Check its routing table and config. – Zac67 Dec 14 '20 at 20:05

Not the answer you're looking for? Browse other questions tagged or ask your own question.