Home / server / Questions / 672286
Accepted
watchmansky
Asked: 2015-03-02 09:03:50 +0800 CST

Is it the normal behavior of arp requests?

  • 772

Sometimes I dive into my network and often I see:

tcpdump -n arp

17:59:15.754508 ARP, Request who-has 192.168.1.65 tell 192.168.1.212, length 28
17:59:16.754401 ARP, Request who-has 192.168.1.65 tell 192.168.1.212, length 28
17:59:17.754449 ARP, Request who-has 192.168.1.65 tell 192.168.1.212, length 28
17:59:18.754505 ARP, Request who-has 192.168.1.65 tell 192.168.1.212, length 28
17:59:19.754435 ARP, Request who-has 192.168.1.65 tell 192.168.1.212, length 28
17:59:20.754422 ARP, Request who-has 192.168.1.65 tell 192.168.1.212, length 28

192.168.1.212 is a primary linux server:

ip addr
2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP qlen 1000
    link/ether c0:4a:00:02:78:c5 brd ff:ff:ff:ff:ff:ff
    inet 192.168.1.212/24 brd 192.168.1.255 scope global eth0
       valid_lft forever preferred_lft forever
    inet6 fe80::c24a:ff:fe02:78c5/64 scope link 
       valid_lft forever preferred_lft forever

does this behavior a problem or warning or what? 192.168.1.65 is a windows client emulated (often turned off).

networking

1 Answers

  1. Best Answer

    What you are observing is server .212 trying to communicate with / identify client .65

    Probably, your DHCP server (.212) is checking if the client lease .65 is actively used/active or not.

    Under most circumstances this can considered normal behavior; however, you are the only one that know if communications between .212 and .65 really are OK.

    • 3