cancel
Showing results for 
Search instead for 
Did you mean: 

Strange ARP output...

VileReynard
All Star
Posts: 11,213
Thanks: 307
Fixes: 11
Registered: ‎01-09-2007

Strange ARP output...

Quote
~ $ arp
Address                  HWtype  HWaddress          Flags Mask            Iface
ANDROID-52A17B268A37763  ether  14:a3:64:41:fb:b7  C                    eth0
TARDIS                  ether  2c:d0:5a:71:3d:93  C                    eth0
router                  ether  a0:21:b7:87:56:18  C                    eth0
192.168.1.254                    (incomplete)                              eth0
ENTERPRISE              ether  00:0c:43:00:44:db  C                    eth0

Isn't 192.168.1.254 the broadcast address?

13 REPLIES
PeeGee
Aspiring Pro
Posts: 1,107
Thanks: 56
Fixes: 3
Registered: ‎05-04-2009

Re: Strange ARP output...

No, 255 is the broadcast address.
Phil
Plusnet Fibre (Sep 2014), Essentials (Feb 2013); ADSL (Apr 2009); Customer since Jan 2004 (on 28kb dial-up)
Using a TP-Link Archer VR600 modem-router.
Community Veteran
Posts: 2,286
Thanks: 109
Fixes: 4
Registered: ‎18-02-2013

Re: Strange ARP output...

Try iftop press P to get the port reference. "sudo iftop -i wlan1" for wifi etc, otherwise just sudo iftop.
bmon is quite funky as well.
VileReynard
All Star
Posts: 11,213
Thanks: 307
Fixes: 11
Registered: ‎01-09-2007

Re: Strange ARP output...

Those are great utility programs - especially iftop - thanks!

IanSn
Grafter
Posts: 492
Thanks: 5
Registered: ‎25-09-2011

Re: Strange ARP output...

So what is 192.168.1.254 then? Noticed it the other day.
MJN
Aspiring Pro
Posts: 1,104
Thanks: 55
Fixes: 2
Registered: ‎26-08-2010

Re: Strange ARP output...

It is often configured as the IP address of the LAN side of the router, and hence is then used as your default gateway (to get off the LAN).
IanSn
Grafter
Posts: 492
Thanks: 5
Registered: ‎25-09-2011

Re: Strange ARP output...

Of course.  Roll eyes  Seeing it blocked as "stealth mode connection attempt" on the terminal (Mac) that had me puzzled. Forgot about it until I saw it here.
Community Veteran
Posts: 2,286
Thanks: 109
Fixes: 4
Registered: ‎18-02-2013

Re: Strange ARP output...

upnp to 224.0.0.X more than likely
IanSn
Grafter
Posts: 492
Thanks: 5
Registered: ‎25-09-2011

Re: Strange ARP output...


- Stealth Mode connection attempt to UDP 192.168.1.180:58222 from 192.168.1.254:53
The AV firewall does this all on its own. The ports I presume. I don't know what either are.
Leaves the 224 ones alone.
MJN
Aspiring Pro
Posts: 1,104
Thanks: 55
Fixes: 2
Registered: ‎26-08-2010

Re: Strange ARP output...

Destination port 53 is DNS.
Community Veteran
Posts: 5,228
Thanks: 495
Fixes: 22
Registered: ‎10-06-2010

Re: Strange ARP output...

That's your AV firewall blocking the router sending you a DNS reply. Probably a false positive.
IanSn
Grafter
Posts: 492
Thanks: 5
Registered: ‎25-09-2011

Re: Strange ARP output...

Looks that way. Doesn't seem to make any difference to anything
VileReynard
All Star
Posts: 11,213
Thanks: 307
Fixes: 11
Registered: ‎01-09-2007

Re: Strange ARP output...

I use 192.168.1.1 as the router LAN-side connection.
My DHCP range is 192.168.1.3 - 192.168.1.100 (historical reasons).
Since that 192.168.1.254 address is in my Linux PC ARP cache (which has no anti-virus) it is very peculiar.
There are Windows machines lurking on my network though...
But as you say, it doesn't make any difference to anything.
BTW doing a
ping 192.168.1.254
doesn't connect - but it puts it in my ARP cache.
I notice that a web page can effectively ping your local network devices - see http://stackoverflow.com/questions/4282151/is-it-possible-to-ping-a-server-from-javascript

IanSn
Grafter
Posts: 492
Thanks: 5
Registered: ‎25-09-2011

Re: Strange ARP output...

Had a few of these on port 67 as well. Don't know what that is. (Yep, windows on this network, too)
Interesting .js stuff. Don't do apps (tho have been thinking (read:procrastinating) about it). Is all that necessary when building apps? Or just someone with time to spare?!