PC Review


Reply
Thread Tools Rate Thread

ARP Who Has help

 
 
Shewman
Guest
Posts: n/a
 
      9th Feb 2004
Hi,

I'm getting some weird network traffic:

Source: Intel_31:01:29
Destination: Broadcast
Protocol: ARP
Info: who has 216.123.177.18? Tell 216.123.177.18

How can I track down 216.123.177.18 - it's not part of our IP scheme.

Thanks


 
Reply With Quote
 
 
 
 
Danny Slye - [MSFT}
Guest
Posts: n/a
 
      9th Feb 2004
Who is Intel_31:01:29? This is the MAC address of the source (the name is
partially resolved to Intel_(the rest of the MAC address)). If you can
ping 216.123.177.18, you will see the unresolved MAC address in your ARP
cache - "arp -a"
--------------------

>
>Hi,
>
>I'm getting some weird network traffic:
>
>Source: Intel_31:01:29
>Destination: Broadcast
>Protocol: ARP
>Info: who has 216.123.177.18? Tell 216.123.177.18
>
>How can I track down 216.123.177.18 - it's not part of our IP scheme.
>
>Thanks
>
>
>


__
Danny Slye
Microsoft Support Professional
MCSE

This posting is provided "AS IS" with no warranties and confers no rights.
Please reply to the newsgroup so that others may benefit. Thanks!

 
Reply With Quote
 
Shewman
Guest
Posts: n/a
 
      9th Feb 2004
Hi Danny,

I've tried ping the address but just get dead air.

Here's the actual info:

Frame 1 (60 bytes on wire, 60 bytes captured)
Ethernet II, Src: 00:03:47:31:01:29, Dst: ff:ff:ff:ff:ff:ff
Destination: ff:ff:ff:ff:ff:ff (Broadcast)
Source: 00:03:47:31:01:29 (216.123.177.18)
Type: ARP (0x0806)
Trailer: 00000000000000000000000000000000...
Address Resolution Protocol (request)


"Danny Slye - [MSFT}" <(E-Mail Removed)> wrote in message
news:08H%(E-Mail Removed)...
> Who is Intel_31:01:29? This is the MAC address of the source (the name

is
> partially resolved to Intel_(the rest of the MAC address)). If you can
> ping 216.123.177.18, you will see the unresolved MAC address in your ARP
> cache - "arp -a"
> --------------------
>
> >
> >Hi,
> >
> >I'm getting some weird network traffic:
> >
> >Source: Intel_31:01:29
> >Destination: Broadcast
> >Protocol: ARP
> >Info: who has 216.123.177.18? Tell 216.123.177.18
> >
> >How can I track down 216.123.177.18 - it's not part of our IP scheme.
> >
> >Thanks
> >
> >
> >

>
> __
> Danny Slye
> Microsoft Support Professional
> MCSE
>
> This posting is provided "AS IS" with no warranties and confers no rights.
> Please reply to the newsgroup so that others may benefit. Thanks!
>



 
Reply With Quote
 
Rob Elder, MVP-Networking
Guest
Posts: n/a
 
      9th Feb 2004
A whois search on dnsstuff.com shows the following owner.

OrgName: Allstream Corp. Corporation Allstream
Address: 200 Wellington Street West
Address: 16th Floor
City: Toronto
StateProv: ON
PostalCode: M5V-3G2
Country: CA

You should not be seeing any part of their MAC address unless it is on your
local subnet. You'd see your default gateways MAC. The router will handle
ARP requests between subnets.



"Shewman" <(E-Mail Removed)> wrote in message
news:m5TVb.2398$(E-Mail Removed)...
> Hi Danny,
>
> I've tried ping the address but just get dead air.
>
> Here's the actual info:
>
> Frame 1 (60 bytes on wire, 60 bytes captured)
> Ethernet II, Src: 00:03:47:31:01:29, Dst: ff:ff:ff:ff:ff:ff
> Destination: ff:ff:ff:ff:ff:ff (Broadcast)
> Source: 00:03:47:31:01:29 (216.123.177.18)
> Type: ARP (0x0806)
> Trailer: 00000000000000000000000000000000...
> Address Resolution Protocol (request)
>
>
> "Danny Slye - [MSFT}" <(E-Mail Removed)> wrote in message
> news:08H%(E-Mail Removed)...
> > Who is Intel_31:01:29? This is the MAC address of the source (the name

> is
> > partially resolved to Intel_(the rest of the MAC address)). If you can
> > ping 216.123.177.18, you will see the unresolved MAC address in your ARP
> > cache - "arp -a"
> > --------------------
> >
> > >
> > >Hi,
> > >
> > >I'm getting some weird network traffic:
> > >
> > >Source: Intel_31:01:29
> > >Destination: Broadcast
> > >Protocol: ARP
> > >Info: who has 216.123.177.18? Tell 216.123.177.18
> > >
> > >How can I track down 216.123.177.18 - it's not part of our IP scheme.
> > >
> > >Thanks
> > >
> > >
> > >

> >
> > __
> > Danny Slye
> > Microsoft Support Professional
> > MCSE
> >
> > This posting is provided "AS IS" with no warranties and confers no

rights.
> > Please reply to the newsgroup so that others may benefit. Thanks!
> >

>
>



 
Reply With Quote
 
Shew
Guest
Posts: n/a
 
      9th Feb 2004
The IP use to be part of our old co-locate on a Red Hat server. I had
already left a message for the Linux guy to see why it's still there.


"Rob Elder, MVP-Networking" <(E-Mail Removed)> wrote in message
news:(E-Mail Removed)...
> A whois search on dnsstuff.com shows the following owner.
>
> OrgName: Allstream Corp. Corporation Allstream
> Address: 200 Wellington Street West
> Address: 16th Floor
> City: Toronto
> StateProv: ON
> PostalCode: M5V-3G2
> Country: CA
>
> You should not be seeing any part of their MAC address unless it is on

your
> local subnet. You'd see your default gateways MAC. The router will

handle
> ARP requests between subnets.
>
>
>
> "Shewman" <(E-Mail Removed)> wrote in message
> news:m5TVb.2398$(E-Mail Removed)...
> > Hi Danny,
> >
> > I've tried ping the address but just get dead air.
> >
> > Here's the actual info:
> >
> > Frame 1 (60 bytes on wire, 60 bytes captured)
> > Ethernet II, Src: 00:03:47:31:01:29, Dst: ff:ff:ff:ff:ff:ff
> > Destination: ff:ff:ff:ff:ff:ff (Broadcast)
> > Source: 00:03:47:31:01:29 (216.123.177.18)
> > Type: ARP (0x0806)
> > Trailer: 00000000000000000000000000000000...
> > Address Resolution Protocol (request)
> >
> >
> > "Danny Slye - [MSFT}" <(E-Mail Removed)> wrote in message
> > news:08H%(E-Mail Removed)...
> > > Who is Intel_31:01:29? This is the MAC address of the source (the

name
> > is
> > > partially resolved to Intel_(the rest of the MAC address)). If you

can
> > > ping 216.123.177.18, you will see the unresolved MAC address in your

ARP
> > > cache - "arp -a"
> > > --------------------
> > >
> > > >
> > > >Hi,
> > > >
> > > >I'm getting some weird network traffic:
> > > >
> > > >Source: Intel_31:01:29
> > > >Destination: Broadcast
> > > >Protocol: ARP
> > > >Info: who has 216.123.177.18? Tell 216.123.177.18
> > > >
> > > >How can I track down 216.123.177.18 - it's not part of our IP scheme.
> > > >
> > > >Thanks
> > > >
> > > >
> > > >
> > >
> > > __
> > > Danny Slye
> > > Microsoft Support Professional
> > > MCSE
> > >
> > > This posting is provided "AS IS" with no warranties and confers no

> rights.
> > > Please reply to the newsgroup so that others may benefit. Thanks!
> > >

> >
> >

>
>



 
Reply With Quote
 
 
 
Reply

Thread Tools
Rate This Thread
Rate This Thread:

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is On
HTML code is Off
Trackbacks are On
Pingbacks are On
Refbacks are Off



Features
 

Advertising
 

Newsgroups
 


All times are GMT +1. The time now is 04:26 PM.