It's due to the latest microsoft worms scanning IP's that aren't currently in use, you'll notice that the arp requests are usually in sequential order. The router will try a few times before giving up, and doesn't cache the response for long. On Sat, Sep 20, 2003 at 12:39:44PM -0500, nick phillips wrote: > hello list, > > just wondered if someone could satisfy my idle curiosity... i just > downloaded ethereal and i've been playing around with capturing network > traffic and looking through the results. i noticed that 99% of my > traffic seems to be ARP requests from 65.27.80.1, with the request being > "who has 65.xx.xx.xx?', with the address apparently cycling through all > IP addresses under the 65 class a network. i assume this is fairly > normal ARP procedure, but could anyone enlighten me as to exactly what's > going on? or recommend a decent link for info? (most of the ones i've > found seem to be more technical detail about the actual protocol, not > how it is used..) i'm finding this network stuff fascinating and i'd > like to try and work out what these various protocols are actually > doing... > > thanks for any info! > > best, > nick > > > _______________________________________________ > TCLUG Mailing List - Minneapolis/St. Paul, Minnesota > http://www.mn-linux.org tclug-list at mn-linux.org > https://mailman.real-time.com/mailman/listinfo/tclug-list -- Matthew S. Hallacy FUBAR, LART, BOFH Certified http://www.poptix.net GPG public key 0x01938203 _______________________________________________ TCLUG Mailing List - Minneapolis/St. Paul, Minnesota http://www.mn-linux.org tclug-list at mn-linux.org https://mailman.real-time.com/mailman/listinfo/tclug-list