EN5861 Diagnostic

I'm seeing a fair number of messages of the form:

ARP: never found xxx.xxx.xxx.xxx

(where xxx.xxx.xxx.xxx is an IP address on my subnet)

Any idea why this should be, if I should worry and how I could stop it ?

RB

It's just probably there from a previous connection, nothing to worry about.

If you want to get rid of them connect with telnet:-

'arp list' will show you what is in the router
'arp delete xx.xx.xx.xx' will delete the IP's you don't need anymore


Steve

Roland Burr wrote:
> I'm seeing a fair number of messages of the form:
>
> ARP: never found xxx.xxx.xxx.xxx
>
> (where xxx.xxx.xxx.xxx is an IP address on my subnet)
>
> Any idea why this should be, if I should worry and how I could stop
> it ?
>
> RB

--

(¯`·._.· All Outgoing Mail Scanned With Norton Anti-Virus 2003 ·._.·´¯)

"Roland Burr" <(E-Mail Removed)> wrote in message
news:(E-Mail Removed) m...
> no, arp list just shows me the one [currently] active IP address
>
> Do I infer that these messages come as a result of some outside system
> trying to access a valid IP address inside my network (port scan or
> something less dodgy for instance) ?
>
> RB

You should only get ARP requests from your own local network. All outside
data would come through the router on your network which also has an ARP
address.

If you genuinely don't recognise the ARP or IP address then someone is
tapping into your LAN!

On 9 Sep 2003 02:27:43 -0700, (E-Mail Removed) (Roland Burr) wrote:

>Do I infer that these messages come as a result of some outside system
>trying to access a valid IP address inside my network (port scan or
>something less dodgy for instance) ?

Yes, a valid IP address that isn't being used by a machine on your
LAN. The router sends a ARP request to find the machine with the IP
address being scanned and when it doesn't get a reply it logs the
message.
--
Andy Norman (E-Mail Removed)
http://www.norman.cx/