So, device is broadcasting, "Who has Tell"

I understand this.

I see no packet where returns to

I understand that it night be directly to; and I might not see it.

But why does ask so many times?

Seem like is either not answering or is sending way to many requests.

Any suggestions?

asked 15 Feb, 15:49

dcalcutt's gravatar image

accept rate: 0%

edited 16 Feb, 10:47

Jim%20Aragon's gravatar image

Jim Aragon

What is "so many times"? ARP cache will time out so it will ask every time it doesn't have it in its cache.

Also, if it is extremely rapid, are you certain the response is making it back to the requester or if the requested host is in fact replying?

(15 Feb, 17:07) Rooster_50

alt text

(16 Feb, 15:19) dcalcutt

But why does ask so many times?

Because it wants to send a packet to, and therefore needs to know its MAC address, but, for whatever reason, isn't responding with its MAC address, and neither is any other device on that LAN segment, so it keeps trying in the hopes that eventually somebody will respond.

That's how ARP works.

I suggest you figure out what's wrong with If what's wrong with it is that it doesn't exist any more, you need to figure out why is trying to send it packets and fix that.


answered 15 Feb, 17:11

Guy%20Harris's gravatar image

Guy Harris ♦♦
accept rate: 19%

Its only occurring for the IP cameras and the DVR that goes with it.

Same manufacturer, so I'm guessing its the cameras.

(16 Feb, 04:49) dcalcutt

I'm assuming that wireshark and only see general packets, as well as packet for the computer I'm using,

Am I correct that if a packet was sent directly from to I would not see it?

(16 Feb, 15:14) dcalcutt

What you see on an Ethernet network depends on how the network is constructed.

If all the hosts on the Ethernet segment are plugged into a real hub, then, if you're capturing in promiscuous mode, you should be able to see all traffic on the network, whether it's being sent to or from the machine doing the capture or not. If you're not capturing in promiscuous mode, you'll see only broadcast traffic, multicast traffic, traffic sent to the machine doing the capturing, and traffic coming from the machine doing the capturing.

If they hosts are plugged into a switch, then, unless the host doing the capturing is plugged into a "mirror port" or "SPAN port" or whatever it's called on the switch in question, whether you're capturing in promiscuous mode or not, you'll see only broadcast traffic, multicast traffic, traffic sent to the machine doing the capturing, and traffic coming from the machine doing the capturing. Only if you capture in promiscuous mode on a mirror/SPAN/whatever port will you see all traffic.

Not all switches support mirror/SPAN/whatever ports. Many devices such as DSL and cable modems, Wi-Fi routers, and even some "hubs" ("switching hubs") are, in fact, switches.

(16 Feb, 22:32) Guy Harris ♦♦

The ARP requests are send with a frequency of 1 per second. This is usually an indicator, that the ARP request was never answered.

You might want to check the configuration, if is referenced somewhere as DVR, gateway, DNS server, time server or somewhere else in the configuration. Please note, that certain parameters might be set a DHCP server.

To understand the situation you need a trace file from the point of view of As Guy Harris pointed out, this requires a hub or a SPAN port.

Good hunting


answered 17 Feb, 11:30

packethunter's gravatar image

accept rate: 7%

Well the computer I'm using to capture the packets, is on a switch.

I'm going to run the Ethernet to the router to see if that makes a difference.

(10 Mar, 16:44) dcalcutt

WEll, that made no difference.

I even tried making my computer the same IP address as the router, just to see what would happen. But I got nothing interesting.

I just want to know if the router is responding to all the request for the MAC addesses

(10 Mar, 17:09) dcalcutt
Your answer
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here



Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text]( "Title")
  • image?![alt text](/path/img.jpg "Title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported



Asked: 15 Feb, 15:49

Seen: 277 times

Last updated: 10 Mar, 17:09

Related questions

p​o​w​e​r​e​d by O​S​Q​A