We have static IP from our ISP, and ARP cache table on our router is showing over hundred internet addresses.
Many of these addresses are on same subnet as our public IP, and many others are remote.
Would you help me find out what could be happening?
Thanks
This Question has been solved and asker verified All Experts Exchange premium technology solutions are available to subscription members.
Experts Exchange has been collecting answers to technology questions since 1996…3 million and counting! If you have a question, chances are we already have your answer.
If you can't find the exact answer you're looking for, ask our exclusive community of 50,000 experts. You’ll get a personalized answer from a trusted professional.
Thousands of free tech tips, tricks, how-to’s and tutorials are available in our peer reviewed articles section. See for yourself how smart our experts are, no login required.
Save solutions to your questions, answers you’ve discovered through searching plus helpful articles in your personal knowledgebase for easy future access.
Access the answers to your technology questions today.
30-day free trial. Register in 60 seconds.
Members of the expert community talk about why the experience at Experts Exchange is different than what you will find anywhere else.
Try it out and discover for yourself.
30-day free trial. Register in 60 seconds.
Join the community of experts here and help other tech pros by answering question in your area of expertise. You can earn FREE access to all Experts Exchange's premium features and resources.
Thank you for such quick answer.
If my router's public IP is : 1.2.3.x (subnet mask = 255.255.255.0)
On router's ARP cache there are many addresses like this: 1.2.w.z -> other devices on same network segment?
And what about the other addresses that aren't on same network? Why are they on my arp cache?
Sorry, maybe I'm not explaining it right.
On our router's ARP cache table I see:
All ip-mac from our private LAN. (example IP: 192.168.62.x)
+
A lot of ip-mac from our ISP's network -> these IPs have the same 2 first octects than our public IP. (example IP: 1.2.x.y)
+
Several ip-mac that don't belong to our LAN, and don't belong to our ISP's network. Why are these on arp table if they aren't on same networks than our router?
Also the same mac appears with different ips. (example: 169.254.x.x, 169.254.y.y, 10.15.z.z -> same mac address).
This is the information the ISP gave us to set up our router:
Public IP 190.14.173.x ,default gateway 190.14.173.1, subnet mask 255.255.255.0
So I expected to see at arp table -> ips like 190.14.173....
But I see all 190.14...... (examples: 190.14.160..., 190.14.164....., 190.14.167......, etc)
And also ips from other networks : 10.15......, 169.254......, 172.16......, 201.251.......
The mac with several ips didn't have any ip in 190.14...
Generally speaking a router would not have ARP entries for anything outside its local subnets but with a microwave interface it may be that it is set up to cache an entry for anything it hears a source mac address for. That would mean anything that transmits in that frequency range. It could be just the way it is designed or it could be that it is configured incorrectly. In either case it is something on the ISP side and they may or may not have any control over it.
I agree with Rick_O_Shay. Especially since the microwave is a multi-point connection. I don't know exactly how this is setup and who actually owns the router, but the ISP could be using this as a relay for other customers/subnets.
When I originally asked about what type of Internet connection I was going down the path that this could be a cable connection where it is a shared media for everybody.
Who owns the router? Is the connection setup so that the router should only see your traffic/subnet?
The router belongs to the firm where I work, it has not been provided nor configured by the ISP.
It's a dual WAN router, Draytek Vigor 2910. The connection we're talking about is WAN1 (always on, wan2 is an adsl connection from another isp and activates when wan1 fails)
It has this option:
WAN connection detection: ARP detection ->( this is the default option, the others are Ping detection and Always on)
Should I change it to ping detection?
Well, any link ("carrier"...:) might carry any number of IP networks simultaneously, so regarsless of who is to blame, that is happening to you. The 169.254... adresses are APIPA abominations, er, addresses... That is commonly what at least some implementations will default to, when failing DHCP (or BOOTP, if a bit older) negtiation. So someone on that segment might be having problems with dynamic address aquisition. Check that it isn't your clients acting up.
Also worth checking is that collegues don't connect any portables in a ... bad way. On a router, that just might explain some of the bad things. Unless you can see it all coming from the WAN1 inteface, in which case it'd be your problem only secondarily. As mentioned, ARP requests wouldn't be routable, so any problem would e fairly local:-).
If you clear the cache, does it build up with the "nonsense" pairs fairly quickly?
Note that I'm not in disagreement with anything said earlier. On the contrary. I'm just pointing at a) ARP requests for multiple IP networks "on the same wire" can show in the cache, although the router itself know nothing about them (might depend on your setting there, so ... you could play with the "Always On" or ping alternatives), and b) One might miss what IF is actually having the requests (bitter experience talking;-).
Cheers
-- Glenn
This is a small environment, so all devices on LAN have static ips and as far as I know nobody connects any portable device, it seems all these foreign addresses are coming from ISP's network.
I changed wan connection detection from 'arp' to 'ping' and to 'always on', and the result is the same, the ARP table builds up with all these pairs almost inmediatly.
So, if it is an ISP's issue, is this a bad practice that is putting my security on risk? Or is this a common situation and I shoudn't be worried?
So their end is some kind of bridge then,likely? Not that uncommon, but not really common either, I suppose. I've seen both, and really... You are always at risk, when connected;-). Use a good FW:D. But I can't really see that it'd add much risk to your setup. You could always tel them to filter it for you... Some ISPs would do that anyway... if the equipment involved can, that is.
Cheers
-- Glenn
Since it is an open network, the radio frequency in use, everybody can hear everybody else. There's really nothing you can do about that. The fact that the router is caching arps for those other stations it hears out there is probably not much of an issue. It is probably just the way that router is designed for that type of layer 2 network. Normally a router would not have an ARP for just anyone it hears but only for those devices it is specifically looking for or ones looking for it. In the case of radio it is just caching anyone it hears assuming it may have to talk to them.
Business Accounts
Answer for Membership
by: carlson777Posted on 2009-09-01 at 09:38:57ID: 25233343
Your ISP as put you on a shared network segment as you are seeing layer 2 traffic.