Charter ARP Leak
jared at puck.Nether.net
Mon Dec 29 17:52:33 UTC 2014
On Mon, Dec 29, 2014 at 11:12:34AM -0600, Rampley Jr, Jim F wrote:
> On 12/29/14, 10:49 AM, "Valdis.Kletnieks at vt.edu" <Valdis.Kletnieks at vt.edu>
> >On Mon, 29 Dec 2014 03:44:48 +0000, "Stephen R. Carter" said:
> >> Here is a small excerpt I am seeing.
> >> 06:04:04.760869 In 00:21:a0:fb:53:d9 > ff:ff:ff:ff:ff:ff, ethertype
> >>ARP (0x0806), length 60: arp who-has 184.108.40.206 tell 220.127.116.11
> >> 06:04:04.761950 In 00:21:a0:fb:53:d9 > ff:ff:ff:ff:ff:ff, ethertype
> >>ARP (0x0806), length 60: arp who-has 18.104.22.168 tell 22.214.171.124
> >The interesting thing is that they're all .1 addresses. It's almost as if
> >the one broadcast domain has at least 7 different address spaces on it.
> Valdis, you are correct. What your seeing is caused by multiple IP blocks
> being assigned to the same CMTS interface.
I would be way more interested in seeing the NDP entries than the ARP
Jared Mauch | pgp key available via finger from jared at puck.nether.net
clue++; | http://puck.nether.net/~jared/ My statements are only mine.
More information about the NANOG