This is our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

Did a capture today which showed my laptop sending ARP after ARP requests to unknown IP addresses.

Example:

182 38.717398 HonHaiPr_7c:4c:f9 Broadcast ARP 42 Who has 192.168.1.135? Tell 192.168.1.130 24 10.035381 HonHaiPr_7c:4c:f9 Broadcast ARP 42 Who has 192.168.1.1? Tell 192.168.1.130 28 16.794527 HonHaiPr_7c:4c:f9 Broadcast ARP 42 Who has 192.168.1.108? Tell 192.168.1.130

alt text


Looking for assistance on how to determine what service or program might be causing this?

asked 21 Jun '17, 16:15

geo3d's gravatar image

geo3d
6112
accept rate: 0%

edited 24 Jun '17, 06:59

grahamb's gravatar image

grahamb ♦
19.8k330206


At first look what IP address does your laptop have. I see unicast packet no.134 sourced from IP 192.168.1.142. Probably this is your address. Whereas ARP requests contain "Tell 192.168.1.130", it means they're sourced from 192.168.1.130. So it can be someone's else laptop sending these ARPs and you see them just because they are broadcasts.

As for ARPs themselves, this looks like ARP scan. It can be some monitoring software doing discovery. But at first - be sure what PC is the source of it.

permanent link

answered 22 Jun '17, 02:13

Packet_vlad's gravatar image

Packet_vlad
4361613
accept rate: 20%

edited 22 Jun '17, 02:14

PVlad, thanks and yes the ARP requests are coming from my wife's laptop (sorry I wasn't more clear on that). She's been having some bandwidth issues lately so I first changed wifi channels to something with much less traffic then next day did a scan for further troubleshooting. That's when I noticed the numerous ARP scans. Did a lookup on the web and noticed someone else came across same exact issue but no resolution was provided. I'm trying to pinpoint the source program that is sending the ARP requests.

(22 Jun '17, 04:36) geo3d
-1

Look for malware.

permanent link

answered 22 Jun '17, 09:08

Velas's gravatar image

Velas
2113
accept rate: 0%

Your answer
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here

By RSS:

Answers

Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text](http://url.com/ "title")
  • image?![alt text](/path/img.jpg "title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Question tags:

×78
×1

question asked: 21 Jun '17, 16:15

question was seen: 1,259 times

last updated: 24 Jun '17, 06:59

p​o​w​e​r​e​d by O​S​Q​A