Charter ARP Leak

Rampley Jr, Jim F jim.rampley at charter.com
Mon Dec 29 17:12:34 UTC 2014





On 12/29/14, 10:49 AM, "Valdis.Kletnieks at vt.edu" <Valdis.Kletnieks at vt.edu>
wrote:

>On Mon, 29 Dec 2014 03:44:48 +0000, "Stephen R. Carter" said:
>> Here is a small excerpt I am seeing.
>> 
>> 06:04:04.760869  In 00:21:a0:fb:53:d9 > ff:ff:ff:ff:ff:ff, ethertype
>>ARP (0x0806), length 60: arp who-has 97.85.59.219 tell 97.85.58.1
>> 06:04:04.761950  In 00:21:a0:fb:53:d9 > ff:ff:ff:ff:ff:ff, ethertype
>>ARP (0x0806), length 60: arp who-has 75.135.155.27 tell 75.135.152.1
>
>The interesting thing is that they're all .1 addresses.  It's almost as if
>the one broadcast domain has at least 7 different address spaces on it.

Valdis, you are correct.  What your seeing is caused by multiple IP blocks
being assigned to the same CMTS interface.





More information about the NANOG mailing list