Wireshark-users: Re: [Wireshark-users] Help on data from wiresharck
Date Index · Thread Index · Other Months · All Mailing Lists
Date Prev · Date Next · Thread Prev · Thread Next
From: Anne Blankert <anne.blankert@xxxxxxxxx>
Date: Thu, 5 Oct 2017 11:26:34 +0200
I interpret 

2336    191.200998    HuaweiTe_21:8d:a5    Broadcast    ARP 60    Who has 169.254.88.123? Tell 192.168.1.111

as:

A network device, made by Huawei, is asking all machines connected to the network for the MAC-address of machine with link-local ipv4 address 169.254.88.123. The network device claims the answer should be sent to 192.168.1.111. Normally, this means that the Huawei device is using ip 192.168.1.111.

For some reason device 192.168.1.111 tries to contact link-local address 169.254.88.123. This happens when the device is configured to contact link-local addresses and something tries to contact the specified link-local address (169.254.88.123).

If 192.168.1.111 is configured as gateway, the ARP request can happen if either the gateway or some other device on the network wants to contact 169.254.88.123 and forwards the packet to the gateway. If the gateway is configured to lookup link-local addresses on the local network, then the gateway will issue an ARP to discover the MAC address of that device.

Anne

2017-10-04 13:26 GMT+02:00 Guy Harris <guy@xxxxxxxxxxxx>:
On Oct 4, 2017, at 4:07 AM, Antonio Bernabei <abernabei@xxxxxxxxxxxxxxxxxx> wrote:

> But why there is
>
> HuaweiTe
>
> Is it a phone trying to connect to our lan?

Not necessarily.  "HuaweiTe" is short for "Huawei Technologies Co.", and Huawei offer servers:

        http://e.huawei.com/en/products/cloud-computing-dc/servers

and storage equipment:

        http://e.huawei.com/en/products/cloud-computing-dc/storage

and networking equipment:

        http://e.huawei.com/en/products/enterprise-networking/switches

        http://e.huawei.com/en/products/enterprise-networking/routers

as well as telecommunications equipment.  ("Te" isn't short for "telecommunications" or "telephone" or....)
___________________________________________________________________________
Sent via:    Wireshark-users mailing list <wireshark-users@xxxxxxxxxxxxx>
Archives:    https://www.wireshark.org/lists/wireshark-users
Unsubscribe: https://www.wireshark.org/mailman/options/wireshark-users
             mailto:wireshark-users-request@xxxxxxxxxxxxx?subject=unsubscribe