nick phillips writes: > i noticed that 99% > of my traffic seems to be ARP requests from 65.27.80.1, with the > request being "who has 65.xx.xx.xx?', with the address apparently > cycling through all IP addresses under the 65 class a network. This usually means that the computers that own those IP addresses are not running (or more specifically, answering ARP requests), but traffic is still going to them. When the router/switch gets a packet for one of those IPs, it sends an ARP request to determine where to send it. Since they never respond, the cycle repeats itself. If you wanted to have some fun, you could use arpspoof to reply to all of the requests. -- David Phillips <david at acz.org> http://david.acz.org/ _______________________________________________ TCLUG Mailing List - Minneapolis/St. Paul, Minnesota http://www.mn-linux.org tclug-list at mn-linux.org https://mailman.real-time.com/mailman/listinfo/tclug-list