cancel
Showing results for 
Search instead for 
Did you mean: 

Strange ARP output...

VileReynard
Hero
Posts: 12,616
Thanks: 582
Fixes: 20
Registered: ‎01-09-2007

Strange ARP output...

Quote
~ $ arp
Address                  HWtype  HWaddress          Flags Mask            Iface
ANDROID-52A17B268A37763  ether  14:a3:64:41:fb:b7  C                    eth0
TARDIS                  ether  2c:d0:5a:71:3d:93  C                    eth0
router                  ether  a0:21:b7:87:56:18  C                    eth0
192.168.1.254                    (incomplete)                              eth0
ENTERPRISE              ether  00:0c:43:00:44:db  C                    eth0

Isn't 192.168.1.254 the broadcast address?

"In The Beginning Was The Word, And The Word Was Aardvark."

13 REPLIES 13
PeeGee
Pro
Posts: 1,217
Thanks: 84
Fixes: 3
Registered: ‎05-04-2009

Re: Strange ARP output...

No, 255 is the broadcast address.
Phil
Plusnet FTTC (Sep 2014), Essentials (Feb 2013); ADSL (Apr 2009); Customer since Jan 2004 (on 28kb dial-up)
Using a TP-Link Archer VR600 modem-router.
30FTTC06
Pro
Posts: 2,286
Thanks: 108
Fixes: 4
Registered: ‎18-02-2013

Re: Strange ARP output...

Try iftop press P to get the port reference. "sudo iftop -i wlan1" for wifi etc, otherwise just sudo iftop.
bmon is quite funky as well.
VileReynard
Hero
Posts: 12,616
Thanks: 582
Fixes: 20
Registered: ‎01-09-2007

Re: Strange ARP output...

Those are great utility programs - especially iftop - thanks!

"In The Beginning Was The Word, And The Word Was Aardvark."

IanSn
Rising Star
Posts: 565
Thanks: 31
Registered: ‎25-09-2011

Re: Strange ARP output...

So what is 192.168.1.254 then? Noticed it the other day.
MJN
Pro
Posts: 1,318
Thanks: 161
Fixes: 5
Registered: ‎26-08-2010

Re: Strange ARP output...

It is often configured as the IP address of the LAN side of the router, and hence is then used as your default gateway (to get off the LAN).
IanSn
Rising Star
Posts: 565
Thanks: 31
Registered: ‎25-09-2011

Re: Strange ARP output...

Of course.  Roll_eyes  Seeing it blocked as "stealth mode connection attempt" on the terminal (Mac) that had me puzzled. Forgot about it until I saw it here.
30FTTC06
Pro
Posts: 2,286
Thanks: 108
Fixes: 4
Registered: ‎18-02-2013

Re: Strange ARP output...

upnp to 224.0.0.X more than likely
IanSn
Rising Star
Posts: 565
Thanks: 31
Registered: ‎25-09-2011

Re: Strange ARP output...


- Stealth Mode connection attempt to UDP 192.168.1.180:58222 from 192.168.1.254:53
The AV firewall does this all on its own. The ports I presume. I don't know what either are.
Leaves the 224 ones alone.
MJN
Pro
Posts: 1,318
Thanks: 161
Fixes: 5
Registered: ‎26-08-2010

Re: Strange ARP output...

Destination port 53 is DNS.
ejs
Aspiring Hero
Posts: 5,442
Thanks: 631
Fixes: 25
Registered: ‎10-06-2010

Re: Strange ARP output...

That's your AV firewall blocking the router sending you a DNS reply. Probably a false positive.
IanSn
Rising Star
Posts: 565
Thanks: 31
Registered: ‎25-09-2011

Re: Strange ARP output...

Looks that way. Doesn't seem to make any difference to anything
VileReynard
Hero
Posts: 12,616
Thanks: 582
Fixes: 20
Registered: ‎01-09-2007

Re: Strange ARP output...

I use 192.168.1.1 as the router LAN-side connection.
My DHCP range is 192.168.1.3 - 192.168.1.100 (historical reasons).
Since that 192.168.1.254 address is in my Linux PC ARP cache (which has no anti-virus) it is very peculiar.
There are Windows machines lurking on my network though...
But as you say, it doesn't make any difference to anything.
BTW doing a
ping 192.168.1.254
doesn't connect - but it puts it in my ARP cache.
I notice that a web page can effectively ping your local network devices - see http://stackoverflow.com/questions/4282151/is-it-possible-to-ping-a-server-from-javascript

"In The Beginning Was The Word, And The Word Was Aardvark."

IanSn
Rising Star
Posts: 565
Thanks: 31
Registered: ‎25-09-2011

Re: Strange ARP output...

Had a few of these on port 67 as well. Don't know what that is. (Yep, windows on this network, too)
Interesting .js stuff. Don't do apps (tho have been thinking (read:procrastinating) about it). Is all that necessary when building apps? Or just someone with time to spare?!