Getting a lot of Who has 10.0.30.30? Tell 10.0.30.1

answered 2020-02-17 17:15:30 +0000

flag of United Kingdom of Great Britain and Northern Ireland

23790 ●4 ●950 ●227 https://www.wireshark.org

This is an ARP request. Some process on 10.0.30.1 is looking for the MAC address of 10.0.30.30, likely because it wants to send some traffic on it.

10.0.30.1 seems likely to be a gateway device (by the .1 IP) so does it have a static route or forwarding rule for the .30 IP?

edit flag offensive delete link

Comments

30.1 is the gateway. static route 10.0.30.0 for vlan 30. The arp table doesn't show a 30.30 ip, though.

samwifgac ( 2020-02-17 17:27:35 +0000 )edit

Can you capture traffic coming into 10.0.30.1 on its other interfaces, either by running a sniffer on the gateway or by using a tap of some sort? Perhaps some host on a network other than the one on which you saw the ARP requests is sending a packet to the gateway to be forwarded to 10.0.30.30.

Guy Harris ( 2020-02-17 17:46:16 +0000 )edit

new to wireshark so I'm not certain. If its possible from within Wireshark, I'd need a little push in the right direction.

samwifgac ( 2020-02-17 20:22:20 +0000 )edit

add a comment

Getting a lot of Who has 10.0.30.30? Tell 10.0.30.1

1 Answer

Comments

Your Answer

Question Tools

Stats

Getting a lot of Who has 10.0.30.30? Tell 10.0.30.1 edit

1 Answer

Comments

Your Answer

Question Tools

Stats

Getting a lot of Who has 10.0.30.30? Tell 10.0.30.1