1

I'm trying to review a Wireshark capture and it seems the network is heavily flooded with ARP requests that make no sense to me.

  1. The destination is not "Broadcast", but some unknown DELL device (none are present on the network).
  2. The "who-has" IP is not part of the same network the pc is capturing from.
  3. The "tell" IP is not part of the same network either.

ARP requests example

Any ideas of what could be going on here?

Improve this question
5
  • What/where was this capture taken?
    – Ron Trunk
    Dec 14, 2020 at 19:37
  • On a Desktop, connected via Ethernet. Capture has been taken with wireshark.
    – Guest
    Dec 14, 2020 at 19:44
  • Trace down the source of the traffic, and check the system sending them. Looks sorta like what a load balancing device does to verify reachability. I would suspect a misconfigured thing (VM?) before "hackerz!?!" (It could also be a broken DHCP client using the wrong interface.)
    – Ricky
    Dec 14, 2020 at 21:11
  • 1
    "I'm not the owner of the network" Unfortunately, questions about networks you do not directly control are off-topic here.
    – Ron Maupin ♦
    Dec 15, 2020 at 3:15
  • The destination Mac aged out of the forwarding tables of the switches between you and the sender.
    – user253751
    Dec 15, 2020 at 20:30

1 Answer 1

Reset to default
0

Likely, someone has connected a rogue device to your network.

You need to look for the source MAC address. If that is unknown, check the switch's MAC address table for the source port. Work your way back from there, across your switches, to the port of the source device. Disconnect or shut down the device.

Improve this answer
8
  • 1
    The source MAC looks suspiciously fake
    – Ron Trunk
    Dec 14, 2020 at 19:51
  • The thing is the IP address for the suspicious device literally ends with .230.1 whereas the IP addresses of devices connected to the network all end with .227.XXX. It doesn't look like that IP can be part of the same network.
    – Guest
    Dec 14, 2020 at 19:57
  • Unless you know that IP network address it doesn't really matter. A device can send anything. You need to track the source MAC.
    – Zac67 ♦
    Dec 14, 2020 at 20:00
  • Source MAC is 00:11:22:33:44:55, which matches the router's one, but is also a commonly spoofed MAC address i guess.
    – Guest
    Dec 14, 2020 at 20:02
  • Pretty weird address for a router - a manual MAC should be LAA instead of UAA... Your router might be trying to ARP that address. Check its routing table and config.
    – Zac67 ♦
    Dec 14, 2020 at 20:05

Not the answer you're looking for? Browse other questions tagged or ask your own question.