Charter ARP Leak
Rampley Jr, Jim F
jim.rampley at charter.com
Mon Dec 29 17:12:34 UTC 2014
On 12/29/14, 10:49 AM, "Valdis.Kletnieks at vt.edu" <Valdis.Kletnieks at vt.edu>
>On Mon, 29 Dec 2014 03:44:48 +0000, "Stephen R. Carter" said:
>> Here is a small excerpt I am seeing.
>> 06:04:04.760869 In 00:21:a0:fb:53:d9 > ff:ff:ff:ff:ff:ff, ethertype
>>ARP (0x0806), length 60: arp who-has 188.8.131.52 tell 184.108.40.206
>> 06:04:04.761950 In 00:21:a0:fb:53:d9 > ff:ff:ff:ff:ff:ff, ethertype
>>ARP (0x0806), length 60: arp who-has 220.127.116.11 tell 18.104.22.168
>The interesting thing is that they're all .1 addresses. It's almost as if
>the one broadcast domain has at least 7 different address spaces on it.
Valdis, you are correct. What your seeing is caused by multiple IP blocks
being assigned to the same CMTS interface.
More information about the NANOG