This is a static archive of our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

Gratuitous ARP

0

I have a very small network consisting of 2 MAC minis, 3 Windows PCs, TP-Link router, a Linksys router in bridge mode to act as a wireless repeater and security system DVR. All the Windows PCs report gratuitous ARPS every 2 to 3 seconds from a device that we do not recognize. I have researched this and I still don't understand why we are getting these. Source : Shenzhen_12:15:40 (ec:71:db:12:15:40)They occur when wireless access is disabled. Does anyone have any ideas? What have I missed? Is there any way to attach a sample (10 frames) to this?

Thanks for any assistance!

asked 19 Jan '16, 16:21

Olde's gravatar image

Olde
6115
accept rate: 0%

You can upload your trace file to somewhere publicly accessible, like Google Drive, Dropbox, or Cloudshark (www.cloudshark.org) and then edit your question to include the link. There isn't any way to upload here.

(19 Jan '16, 17:03) Jim Aragon

While you upload the file... You can have a look here http://crnetpackets.com/2015/08/28/special-type-of-arp-packets/

(19 Jan '16, 22:13) Christian_R

One Answer:

2

All the Windows PCs report gratuitous ARPS every 2 to 3 seconds from a device that we do not recognize. I have researched this and I still don't understand why we are getting these. Source : Shenzhen_12:15:40 (ec:71:db:12:15:40)

ec:71:db is the vendor code for "Shenzhen Baichuan Digital Technology Co., Ltd." (http://www.sz-bcs.com.cn/). They produce/sell IP cameras and DVRs, so the ARPs are most certainly coming from you own DVR system.

Why is it sending the ARPs? I don't know and (most certainly) we won't be able to figure out by looking at the capture file.

Probably nothing you should be worried about, but that's a question that should be answered by the vendor of the product.

Regards
Kurt

answered 19 Jan '16, 18:43

Kurt%20Knochner's gravatar image

Kurt Knochner ♦
24.8k1039237
accept rate: 15%

edited 19 Jan '16, 18:45

Thanks to all who responded. I was suspecting the DVR. However, at this time I do not have access to the configuration of the DVR. I am working with the installer to try and resolve this.

Olde

(20 Jan '16, 08:52) Olde