empty01
December 24th, 2005, 03:47 AM
First, please forgive me if I am not posting this in the right place. I am running Windows XP on a Motorola cable modem. On an almost regular basis I notice the light flashing on the modem implying activity when I am not active. So ran Ethereal and I find multiple ARP requests from the same IP. I am also seeing DHCP packets from a different IP but always the same. What follows is a brief excerpt:
No. Time Source Destination Protocol Info
28 1.287687 67.188.xx.x Broadcast ARP Who has 67.188.xx.xxx? Tell 67.188.xx.x
Frame 28 (60 bytes on wire, 60 bytes captured)
Ethernet II, Src: 00:01:5c:22:a3:c2, Dst: ff:ff:ff:ff:ff:ff
Address Resolution Protocol (request)
No. Time Source Destination Protocol Info
29 1.334740 10.146.64.1 255.255.255.255 DHCP DHCP Offer - Transaction ID 0xb39b5c75
Frame 29 (348 bytes on wire, 348 bytes captured)
Ethernet II, Src: 00:01:5c:22:a3:c2, Dst: ff:ff:ff:ff:ff:ff
Internet Protocol, Src Addr: 10.146.64.1 (10.146.64.1), Dst Addr: 255.255.255.255 (255.255.255.255)
User Datagram Protocol, Src Port: bootps (67), Dst Port: bootpc (68)
Bootstrap Protocol
The DHCP comes in at 10% the ARP 90% roughly. Should I be worried or is it normal? For that matter is there any way I can stop it?
Thanks
No. Time Source Destination Protocol Info
28 1.287687 67.188.xx.x Broadcast ARP Who has 67.188.xx.xxx? Tell 67.188.xx.x
Frame 28 (60 bytes on wire, 60 bytes captured)
Ethernet II, Src: 00:01:5c:22:a3:c2, Dst: ff:ff:ff:ff:ff:ff
Address Resolution Protocol (request)
No. Time Source Destination Protocol Info
29 1.334740 10.146.64.1 255.255.255.255 DHCP DHCP Offer - Transaction ID 0xb39b5c75
Frame 29 (348 bytes on wire, 348 bytes captured)
Ethernet II, Src: 00:01:5c:22:a3:c2, Dst: ff:ff:ff:ff:ff:ff
Internet Protocol, Src Addr: 10.146.64.1 (10.146.64.1), Dst Addr: 255.255.255.255 (255.255.255.255)
User Datagram Protocol, Src Port: bootps (67), Dst Port: bootpc (68)
Bootstrap Protocol
The DHCP comes in at 10% the ARP 90% roughly. Should I be worried or is it normal? For that matter is there any way I can stop it?
Thanks