Wireshark-users: Re: [Wireshark-users] ARP Broadcasts
From: Sake Blok <sake@xxxxxxxxxx>
Date: Tue, 22 Jan 2008 23:39:00 +0100
On Tue, Jan 22, 2008 at 12:27:24PM -1000, Acy Nonyxx wrote:
> I have broadband through my cable company. I unplugged the router and
> plugged my computer directly into the cable modem and ran wireshark to see
> what I would see.
> What I see most is almost non-stop ARP broadcasts coming from the gateway
> and going to all sorts of ip addresses, "Who has <ipaddress> Tell
> <ipaddress>"
> Is this normal? Should I be picking this up? What kind of network would
> result in me getting all these ARP packets?

Yes, this is quite common for Internet-over-cable networks. They are
often just flat networks with large subnets, ie large broadcast-domains.
In LAN environments the broadcast domains are usually designed a lot
smaller. Therefor you are not used to seeing that much arp broadcasts.

If you look at the ip-addresses in the arp packets, you can map
how large the subnets are, that share the broadcast domain with
you :-)

Cheers,
   Sake