Talking to Mommy

So, the PHB's computer is doing windows update, and I got up to walk
all the way up front (~75 ft, through a cold machine shop), and realized
I can tell when it's done from here. This is what tcpdump gave me just now:

--------------------------<quote>--------------------------------
09:49:40.836590 arp who-has 10.253.117.10 tell 10.254.239.17
09:49:40.836601 arp who-has 10.253.117.8 tell 10.254.239.17
09:49:40.836605 arp who-has 10.253.117.7 tell 10.254.239.17
09:49:40.836614 arp who-has 10.253.117.9 tell 10.254.239.17
09:49:40.836618 arp who-has 10.253.117.6 tell 10.254.239.17
09:49:40.945967 arp who-has 10.253.117.16 tell 10.254.239.17
09:49:40.945971 arp who-has 10.253.117.15 tell 10.254.239.17
09:49:40.945982 arp who-has 10.253.117.13 tell 10.254.239.17
09:49:40.945985 arp who-has 10.253.117.12 tell 10.254.239.17
09:49:40.945996 arp who-has 10.253.117.17 tell 10.254.239.17
09:49:40.946000 arp who-has 10.253.117.14 tell 10.254.239.17
09:49:41.055346 arp who-has 10.253.117.19 tell 10.254.239.17
09:49:41.055357 arp who-has 10.253.117.21 tell 10.254.239.17
09:49:41.055360 arp who-has 10.253.117.18 tell 10.254.239.17
09:49:41.055362 arp who-has 10.253.117.23 tell 10.254.239.17
09:49:41.055373 arp who-has 10.253.117.20 tell 10.254.239.17
09:49:41.055378 arp who-has 10.253.117.22 tell 10.254.239.17
09:49:41.164724 arp who-has 10.253.117.27 tell 10.254.239.17
09:49:41.164727 arp who-has 10.253.117.29 tell 10.254.239.17
09:49:41.164738 arp who-has 10.253.117.24 tell 10.254.239.17
09:49:41.164746 arp who-has 10.253.117.26 tell 10.254.239.17
09:49:41.164748 arp who-has 10.253.117.28 tell 10.254.239.17
09:49:41.164759 arp who-has 10.253.117.25 tell 10.254.239.17
09:49:41.274103 arp who-has 10.253.117.35 tell 10.254.239.17
09:49:41.274107 arp who-has 10.253.117.34 tell 10.254.239.17
09:49:41.274118 arp who-has 10.253.117.32 tell 10.254.239.17
09:49:41.274120 arp who-has 10.253.117.31 tell 10.254.239.17
09:49:41.274131 arp who-has 10.253.117.33 tell 10.254.239.17
09:49:41.274134 arp who-has 10.253.117.30 tell 10.254.239.17
09:49:41.383485 arp who-has 10.253.117.40 tell 10.254.239.17
09:49:41.383488 arp who-has 10.253.117.39 tell 10.254.239.17
09:49:41.383498 arp who-has 10.253.117.37 tell 10.254.239.17
09:49:41.383502 arp who-has 10.253.117.36 tell 10.254.239.17
09:49:41.383511 arp who-has 10.253.117.41 tell 10.254.239.17
09:49:41.383520 arp who-has 10.253.117.38 tell 10.254.239.17
09:49:41.492875 arp who-has 10.253.117.43 tell 10.254.239.17
09:49:41.492882 arp who-has 10.253.117.45 tell 10.254.239.17
09:49:41.492885 arp who-has 10.253.117.47 tell 10.254.239.17
09:49:41.492890 arp who-has 10.253.117.42 tell 10.254.239.17
09:49:41.492894 arp who-has 10.253.117.44 tell 10.254.239.17
09:49:41.492899 arp who-has 10.253.117.46 tell 10.254.239.17
09:49:43.840131 arp who-has thunderbird.dsl-verizon.net tell 10.254.239.20
09:49:43.840179 arp reply thunderbird.dsl-verizon.net is-at 0:2:2a:cb:49:ce
09:49:52.884207 arp who-has 10.253.117.48 tell 10.254.239.17
09:49:52.899792 arp who-has 10.253.117.49 tell 10.254.239.17
09:49:52.915389 arp who-has 10.253.117.50 tell 10.254.239.17
09:49:52.931037 arp who-has 10.253.117.51 tell 10.254.239.17
09:49:52.993557 arp who-has 10.253.117.52 tell 10.254.239.17

rich@Vehicle:~$
-------------------------<end quote>------------------------------
I wonder who the hell 10.253.117.* are? And I don't remember what
"arp" stands for. Address Resolution Protocol?

But it's kind of spooky. Also kind of neat - the time is in milliseconds.
:-)

Apropos nothing. I just thought it was kinda cute. Y'know, like when
you get a new toy you want to show it off to all your friends. And
especially when there's some assembly required. ¿:->

Cheers!
Rich

[Followup-To: header set to alt.os.linux.slackware]
Rich Grise wrote:
> -------------------------<end quote>------------------------------
> I wonder who the hell 10.253.117.* are?

10.*.*.*, like 192.168.*.*, is a range reserved for private use. machines
with such addresses cannot be directly connected to the internet, they need
to go through masquerading/NAT.

> And I don't remember what
> "arp" stands for. Address Resolution Protocol?

yes:

<http://whatis.techtarget.com/definition/0,,sid9_gci213780,00.html>

--
Joost Kremers (E-Mail Removed)
Selbst in die Unterwelt dringt durch Spalten Licht
EN:SiS(9)

In comp.os.linux.networking Rich Grise <(E-Mail Removed)> wrote:
> So, the PHB's computer is doing windows update, and I got up to walk
> all the way up front (~75 ft, through a cold machine shop), and realized
> I can tell when it's done from here. This is what tcpdump gave me just now:
>
> --------------------------<quote>--------------------------------
> 09:49:40.836590 arp who-has 10.253.117.10 tell 10.254.239.17
> 09:49:40.836601 arp who-has 10.253.117.8 tell 10.254.239.17
> 09:49:40.836605 arp who-has 10.253.117.7 tell 10.254.239.17
> 09:49:40.836614 arp who-has 10.253.117.9 tell 10.254.239.17
> 09:49:40.836618 arp who-has 10.253.117.6 tell 10.254.239.17

Hmmm, the first thing to notice here is the lack of any arp replies.
Then of course there is the scanning that would appear to be going on,
supposedly from 10.254.239.17. Hunt that machine down and stomp on it
(if you're the administrator).

> I wonder who the hell 10.253.117.* are?

Try reverse resolving some of the addresses. Doing a traceroute to some
of them may be enlightening too.

--
Cameron Kerr
(E-Mail Removed) : http://nzgeeks.org/cameron/
Empowered by Perl!