Should I worry about Constant ARP requests?

Discussion in 'other firewalls' started by empty01, Dec 24, 2005.

Thread Status:
Not open for further replies.
  1. empty01

    empty01 Registered Member

    Joined:
    Dec 24, 2005
    Posts:
    2
    First, please forgive me if I am not posting this in the right place. I am running Windows XP on a Motorola cable modem. On an almost regular basis I notice the light flashing on the modem implying activity when I am not active. So ran Ethereal and I find multiple ARP requests from the same IP. I am also seeing DHCP packets from a different IP but always the same. What follows is a brief excerpt:

    No. Time Source Destination Protocol Info
    28 1.287687 67.188.xx.x Broadcast ARP Who has 67.188.xx.xxx? Tell 67.188.xx.x

    Frame 28 (60 bytes on wire, 60 bytes captured)
    Ethernet II, Src: 00:01:5c:22:a3:c2, Dst: ff:ff:ff:ff:ff:ff
    Address Resolution Protocol (request)

    No. Time Source Destination Protocol Info
    29 1.334740 10.146.64.1 255.255.255.255 DHCP DHCP Offer - Transaction ID 0xb39b5c75

    Frame 29 (348 bytes on wire, 348 bytes captured)
    Ethernet II, Src: 00:01:5c:22:a3:c2, Dst: ff:ff:ff:ff:ff:ff
    Internet Protocol, Src Addr: 10.146.64.1 (10.146.64.1), Dst Addr: 255.255.255.255 (255.255.255.255)
    User Datagram Protocol, Src Port: bootps (67), Dst Port: bootpc (6:cool:
    Bootstrap Protocol


    The DHCP comes in at 10% the ARP 90% roughly. Should I be worried or is it normal? For that matter is there any way I can stop it?

    Thanks
     
    Last edited by a moderator: Dec 24, 2005
  2. CrazyM

    CrazyM Firewall Expert

    Joined:
    Feb 9, 2002
    Posts:
    2,428
    Location:
    BC, Canada
    Hi empty01

    ... and welcome to Wilders :)

    What you are seeing is quite normal, nothing to worry about and not something you would want to stop.

    Basically ARP is a part of the networking processes that maps an IP address to the corresponding hardware ie. MAC/physical address of your NIC. You will usually see this happening between your system and your gateway server when connected directly to the Internet. On a home network/LAN you would see more of this ARP traffic.

    http://en.wikipedia.org/wiki/Address_Resolution_Protocol

    The DHCP traffic you are seeing is likely from your modem and your ISP's network. DHCP is the process your modem will go through to get it's IP.

    http://en.wikipedia.org/wiki/Dynamic_Host_Configuration_Protocol

    Regards,

    CrazyM
     
  3. empty01

    empty01 Registered Member

    Joined:
    Dec 24, 2005
    Posts:
    2
    Thanks CrazyM. I thought that might be the case but wanted to double check with those that are more knowledgable.
     
Thread Status:
Not open for further replies.
  1. This site uses cookies to help personalise content, tailor your experience and to keep you logged in if you register.
    By continuing to use this site, you are consenting to our use of cookies.