Charter ARP Leak
Rampley Jr, Jim F
jim.rampley at charter.com
Mon Dec 29 17:12:34 UTC 2014
On 12/29/14, 10:49 AM, "Valdis.Kletnieks at vt.edu" <Valdis.Kletnieks at vt.edu>
wrote:
>On Mon, 29 Dec 2014 03:44:48 +0000, "Stephen R. Carter" said:
>> Here is a small excerpt I am seeing.
>>
>> 06:04:04.760869 In 00:21:a0:fb:53:d9 > ff:ff:ff:ff:ff:ff, ethertype
>>ARP (0x0806), length 60: arp who-has 97.85.59.219 tell 97.85.58.1
>> 06:04:04.761950 In 00:21:a0:fb:53:d9 > ff:ff:ff:ff:ff:ff, ethertype
>>ARP (0x0806), length 60: arp who-has 75.135.155.27 tell 75.135.152.1
>
>The interesting thing is that they're all .1 addresses. It's almost as if
>the one broadcast domain has at least 7 different address spaces on it.
Valdis, you are correct. What your seeing is caused by multiple IP blocks
being assigned to the same CMTS interface.
More information about the NANOG
mailing list