Charter ARP Leak
david at davidcoulson.net
Mon Dec 29 17:56:36 UTC 2014
On 12/29/14, 12:51 PM, Jay Ashworth wrote:
> Ok. But the interface to which the cablemodem is attached, in the general
> single-DHCP-IP case, is a /24, is it not?
I'm on TWC. The IP address I get from them is on a /20.
126.96.36.199/20 dev eth7 proto kernel scope link src 104.230.32.x
> The example Valdis posted had 5 or 6 different /24s from all over the v4
> address space; that seems exceptionally sloppy routing...
fw-1:/root # tcpdump -ni eth7 arp
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on eth7, link-type EN10MB (Ethernet), capture size 65535 bytes
12:54:21.354278 ARP, Request who-has 188.8.131.52 tell 184.108.40.206,
12:54:21.355881 ARP, Request who-has 220.127.116.11 tell 18.104.22.168,
We all knows it's easier to add another secondary IP to the interface
and add a new DHCP scope than to try to expand a subnet.
Not sure I understand what all the excitement is about?
More information about the NANOG