Charter ARP Leak

David Coulson david at
Mon Dec 29 17:56:36 UTC 2014

On 12/29/14, 12:51 PM, Jay Ashworth wrote:

> Ok.  But the interface to which the cablemodem is attached, in the general
> single-DHCP-IP case, is a /24, is it not?
I'm on TWC. The IP address I get from them is on a /20. dev eth7  proto kernel  scope link  src 104.230.32.x

> The example Valdis posted had 5 or 6 different /24s from all over the v4
> address space; that seems exceptionally sloppy routing...

fw-1:/root # tcpdump -ni eth7 arp
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on eth7, link-type EN10MB (Ethernet), capture size 65535 bytes
12:54:21.354278 ARP, Request who-has tell, 
length 46
12:54:21.355881 ARP, Request who-has tell, 
length 46

We all knows it's easier to add another secondary IP to the interface 
and add a new DHCP scope than to try to expand a subnet.

Not sure I understand what all the excitement is about?

More information about the NANOG mailing list