Wireshark-users: [Wireshark-users] Scanning subnetwork considered bad or not?
Date Index · Thread Index · Other Months · All Mailing Lists
Date Prev · Date Next · Thread Prev · Thread Next
From: "RUOFF, LARS (LARS)** CTR **" <lars.ruoff@xxxxxxxxxxxxxxxxxx>
Date: Mon, 25 Jul 2011 14:25:29 +0200
Hi,
i was analyzing my home network with my favorite tool ;), when i got seriously scared about the fact that some of my PCs were doing continous ARP requests for the whole address range of the local subnet (/24). Obviously i thought something very bad was going on and that my PCs were infected.

After setting up a trap, i finally found the guilty to be the Canon Network Scanner utility. (The word "Scanner" here initially stands for machines scanning sheets of paper, not networks! ;) )

Ok, so normal behaviour. But isn't this behaviour seriously violating LAN netiquette??
Do a lot of services use this?
I guess that this would be a NO GO in an enterprise environment?

Just wondering...

regards,
Lars