Strange ARP output...

VileReynard · ‎01-09-2007

Quote

~ $ arp
Address                  HWtype  HWaddress           Flags Mask            Iface
ANDROID-52A17B268A37763  ether   14:a3:64:41:fb:b7   C                     eth0
TARDIS                   ether   2c:d0:5a:71:3d:93   C                     eth0
router                   ether   a0:21:b7:87:56:18   C                     eth0
192.168.1.254                    (incomplete)                              eth0
ENTERPRISE               ether   00:0c:43:00:44:db   C                     eth0

Isn't 192.168.1.254 the broadcast address?

"In The Beginning Was The Word, And The Word Was Aardvark."

PeeGee · ‎05-04-2009

No, 255 is the broadcast address.
Phil

Plusnet FTTC (Sep 2014), Essentials (Feb 2013); ADSL (Apr 2009); Customer since Jan 2004 (on 28kb dial-up)
Using a TP-Link Archer VR600 modem-router.

30FTTC06 · ‎18-02-2013

Try iftop press P to get the port reference. "sudo iftop -i wlan1" for wifi etc, otherwise just sudo iftop.
bmon is quite funky as well.

VileReynard · ‎01-09-2007

Those are great utility programs - especially iftop - thanks!

"In The Beginning Was The Word, And The Word Was Aardvark."

IanSn · ‎25-09-2011

So what is 192.168.1.254 then? Noticed it the other day.

MJN · ‎26-08-2010

It is often configured as the IP address of the LAN side of the router, and hence is then used as your default gateway (to get off the LAN).

IanSn · ‎25-09-2011

Of course.

Seeing it blocked as "stealth mode connection attempt" on the terminal (Mac) that had me puzzled. Forgot about it until I saw it here.

30FTTC06 · ‎18-02-2013

upnp to 224.0.0.X more than likely

IanSn · ‎25-09-2011

- Stealth Mode connection attempt to UDP 192.168.1.180:58222 from 192.168.1.254:53
The AV firewall does this all on its own. The ports I presume. I don't know what either are.
Leaves the 224 ones alone.

MJN · ‎26-08-2010

Destination port 53 is DNS.

ejs · ‎10-06-2010

That's your AV firewall blocking the router sending you a DNS reply. Probably a false positive.

IanSn · ‎25-09-2011

Looks that way. Doesn't seem to make any difference to anything

VileReynard · ‎01-09-2007

I use 192.168.1.1 as the router LAN-side connection.
My DHCP range is 192.168.1.3 - 192.168.1.100 (historical reasons).
Since that 192.168.1.254 address is in my Linux PC ARP cache (which has no anti-virus) it is very peculiar.
There are Windows machines lurking on my network though...
But as you say, it doesn't make any difference to anything.
BTW doing a

ping 192.168.1.254

doesn't connect - but it puts it in my ARP cache.
I notice that a web page can effectively ping your local network devices - see http://stackoverflow.com/questions/4282151/is-it-possible-to-ping-a-server-from-javascript

"In The Beginning Was The Word, And The Word Was Aardvark."

IanSn · ‎25-09-2011

Had a few of these on port 67 as well. Don't know what that is. (Yep, windows on this network, too)
Interesting .js stuff. Don't do apps (tho have been thinking (read:procrastinating) about it). Is all that necessary when building apps? Or just someone with time to spare?!