Should I worry about Constant ARP requests?

Discussion in 'other firewalls' started by empty01, Dec 24, 2005.

Thread Status:
Not open for further replies.
  1. empty01

    empty01 Registered Member

    Joined:
    Dec 24, 2005
    Posts:
    2
    First, please forgive me if I am not posting this in the right place. I am running Windows XP on a Motorola cable modem. On an almost regular basis I notice the light flashing on the modem implying activity when I am not active. So ran Ethereal and I find multiple ARP requests from the same IP. I am also seeing DHCP packets from a different IP but always the same. What follows is a brief excerpt:

    No. Time Source Destination Protocol Info
    28 1.287687 67.188.xx.x Broadcast ARP Who has 67.188.xx.xxx? Tell 67.188.xx.x

    Frame 28 (60 bytes on wire, 60 bytes captured)
    Ethernet II, Src: 00:01:5c:22:a3:c2, Dst: ff:ff:ff:ff:ff:ff
    Address Resolution Protocol (request)

    No. Time Source Destination Protocol Info
    29 1.334740 10.146.64.1 255.255.255.255 DHCP DHCP Offer - Transaction ID 0xb39b5c75

    Frame 29 (348 bytes on wire, 348 bytes captured)
    Ethernet II, Src: 00:01:5c:22:a3:c2, Dst: ff:ff:ff:ff:ff:ff
    Internet Protocol, Src Addr: 10.146.64.1 (10.146.64.1), Dst Addr: 255.255.255.255 (255.255.255.255)
    User Datagram Protocol, Src Port: bootps (67), Dst Port: bootpc (6:cool:
    Bootstrap Protocol


    The DHCP comes in at 10% the ARP 90% roughly. Should I be worried or is it normal? For that matter is there any way I can stop it?

    Thanks
     
    Last edited by a moderator: Dec 24, 2005
  2. CrazyM

    CrazyM Firewall Expert

    Joined:
    Feb 9, 2002
    Posts:
    2,428
    Location:
    BC, Canada
    Hi empty01

    ... and welcome to Wilders :)

    What you are seeing is quite normal, nothing to worry about and not something you would want to stop.

    Basically ARP is a part of the networking processes that maps an IP address to the corresponding hardware ie. MAC/physical address of your NIC. You will usually see this happening between your system and your gateway server when connected directly to the Internet. On a home network/LAN you would see more of this ARP traffic.

    http://en.wikipedia.org/wiki/Address_Resolution_Protocol

    The DHCP traffic you are seeing is likely from your modem and your ISP's network. DHCP is the process your modem will go through to get it's IP.

    http://en.wikipedia.org/wiki/Dynamic_Host_Configuration_Protocol

    Regards,

    CrazyM
     
  3. empty01

    empty01 Registered Member

    Joined:
    Dec 24, 2005
    Posts:
    2
    Thanks CrazyM. I thought that might be the case but wanted to double check with those that are more knowledgable.
     
Thread Status:
Not open for further replies.