I have a very small network consisting of 2 MAC minis, 3 Windows PCs, TP-Link router, a Linksys router in bridge mode to act as a wireless repeater and security system DVR. All the Windows PCs report gratuitous ARPS every 2 to 3 seconds from a device that we do not recognize. I have researched this and I still don't understand why we are getting these. Source : Shenzhen_12:15:40 (ec:71:db:12:15:40)They occur when wireless access is disabled. Does anyone have any ideas? What have I missed? Is there any way to attach a sample (10 frames) to this? Thanks for any assistance! asked 19 Jan '16, 16:21  Olde |
One Answer:
ec:71:db is the vendor code for "Shenzhen Baichuan Digital Technology Co., Ltd." (http://www.sz-bcs.com.cn/). They produce/sell IP cameras and DVRs, so the ARPs are most certainly coming from you own DVR system. Why is it sending the ARPs? I don't know and (most certainly) we won't be able to figure out by looking at the capture file. Probably nothing you should be worried about, but that's a question that should be answered by the vendor of the product. Regards answered 19 Jan '16, 18:43  Kurt Knochner ♦ edited 19 Jan '16, 18:45 Thanks to all who responded. I was suspecting the DVR. However, at this time I do not have access to the configuration of the DVR. I am working with the installer to try and resolve this. Olde (20 Jan '16, 08:52) Olde |
You can upload your trace file to somewhere publicly accessible, like Google Drive, Dropbox, or Cloudshark (www.cloudshark.org) and then edit your question to include the link. There isn't any way to upload here.
While you upload the file... You can have a look here http://crnetpackets.com/2015/08/28/special-type-of-arp-packets/