1

How can I find out the source of arp request if it is in another subnet?

view story
linux-howto

http://serverfault.com – Our subnet is connected with other subnets with router. Using wireshark I see some arp requests coming to ip addresses of our subnet from the router. Such as Broadcast ARP 60 Who has 10.162.3.172? Tell 10.162.0.1 Where 10.162.0.1 is the router. I want to determine the source computer from other subnet, which sends this requests. How can I perform it? ()

taskli's picture
Submitted by taskli on 06/19/2012

Stories similar to How can I find out the source of arp request if it is in another subnet?

First I'd describe my subnet A:

a AD controller, say, adcontroller.mydomain with IP 192.168.1.3 a DHCP and DNS server, say, dhcpdns.mydomain with IP 192.168.1.10

Now I have a CISCO WRVS4400N wireless router, plug it through WAN port to the switch of subnet A.

Using Windows Server 2012 Essentials.

I've got two ethernet ports. One is connected to a router which is connected to the internet. This portion of the network is fine. The router runs DHCP on the 192.168.1.x subnet, and provides a Company1 WiFi for guests, which does not have access to servers etc.

The idea is to have a second LAN, through the Windows server.

I have installed a small Linux server; the server is in a different subnet as the internet hosts. I added a route to my nat router to create a connection between both subnets.

This has been bothering me for a couple of days,

I have two subnets:

192.168.1.0/24 : This is the subnet used by my ISP/router.

I have 2 networks that I'd like to connect with a router/firewall to filter traffic between the two. One network is on a public subnet, let's say 64.22.12.192/27 and the other network is on a private subnet 192.168.0.0/24.

This has been bothering me for a couple of days,

I have two subnets:

192.168.1.0/24 : This is the subnet used by my ISP/router.

My employer subscribes to a fiber based leased Internet from a publicly owned incumbent ISP. The ISP admin says that he cannot give a subnet bigger than /30 because he fears that the ISP edge router would become unstable and start rebooting because of ARP broadcast from larger subnets. But I badly require a /29 subnet. I told him that ARP flooding only affects switches and not routers.

Setup:

L2TP VPN Server on a Windows Server 2008 machine which is behind a router, which is behind a modem/router.

Modem/Router (IP: 192.168.2.1, Subnet: 255.255.255.0, DHCP serves 192.168.2.2 to router) ----|_ Router (IP: 192.168.2.2, Subnet: 255.255.255.0, Sub LAN IP: 192.168.0.1, Sub LAN Subnet: 255.255.255.128, DHCP serves 192.168.0.* to computers) ------------|_ Windows Server 2008 (IP: 192.

I'm having trouble with getting local subnet traffic sent through a proxy. I've got some mobile testing devices on a subnet 192.168.0.0 and a web server on that also. For dev purposes, I need to inject some code. I'm using a proxy to do this. However the traffic that is local to the subnet (i.e. from a device, say 192.168.0.2 to the webserver 192.168.0.3) is not passing through the proxy server.