Charter ARP Leak

David Coulson david at davidcoulson.net
Mon Dec 29 17:56:36 UTC 2014


On 12/29/14, 12:51 PM, Jay Ashworth wrote:

> Ok.  But the interface to which the cablemodem is attached, in the general
> single-DHCP-IP case, is a /24, is it not?
I'm on TWC. The IP address I get from them is on a /20.

104.230.32.0/20 dev eth7  proto kernel  scope link  src 104.230.32.x

>
> The example Valdis posted had 5 or 6 different /24s from all over the v4
> address space; that seems exceptionally sloppy routing...

fw-1:/root # tcpdump -ni eth7 arp
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on eth7, link-type EN10MB (Ethernet), capture size 65535 bytes
12:54:21.354278 ARP, Request who-has 173.89.105.161 tell 173.89.96.1, 
length 46
12:54:21.355881 ARP, Request who-has 104.230.27.232 tell 104.230.0.1, 
length 46

We all knows it's easier to add another secondary IP to the interface 
and add a new DHCP scope than to try to expand a subnet.

Not sure I understand what all the excitement is about?



More information about the NANOG mailing list