Stumped by Wireshark: Router Keeps Sending ARP Requests to Host - Suggestions Needed (alien.top)

submitted 2 years ago by RemarkableRough4438@alien.top to c/homenetworking@selfhosted.forum

6 comments fedilink hide all child comments

Hello everyone,

So from my understanding ARP should broadcast, then tables should be updated, and then until an arp table timeout there should be no more need for constant ARP request from say the router to the same host.

When I run wireshark I notice non-broadcast constant arp traffic from my router to my computer. Maybe 20 request in 10 minutes. Its from the router MAC directly to the computers MAC. Why could this be?

Link to Wireshark photo and home network map:

https://imgur.com/a/04eNw3v

top 6 comments

sorted by: hot top new old

[-] AdrianTeri@alien.top 1 points 2 years ago

u/browsing_soup as discussed earlier on your 2 router setup this is how one part of the problem(ARP ..other is IP) start to arise.

[-] Cohnman18@alien.top 1 points 2 years ago

You guys are way over my head in networking, but I truly enjoyed your “chatter” and learned a lot about the nuances of networking. THANK YOU!

[-] bchiodini@alien.top 1 points 2 years ago

See RFC 1122, section 2.3.2.1.

Is the capture filtered or is .252 down?, since I don't see .252 respond.

[-] RemarkableRough4438@alien.top 1 points 2 years ago

Hi Im going through it now

i see "Unicast Poll -- Actively poll the remote host by
periodically sending a point-to-point ARP Request
to it, and delete the entry if no ARP Reply is
received from N successive polls. Again, the
timeout should be on the order of a minute, and
typically N is 2."

im assuming this is what you are referring to. I didn't know this was a thing or common. Why do we have an arp table if we do uni-cast polls as well?

[-] RemarkableRough4438@alien.top 1 points 2 years ago

also seems odd the .252 doesnt ever seem to respond to the .1 I just looked through the picture again, and im not seeing it respond

[-] stikko@alien.top 1 points 2 years ago

It’s effectively a host-firewall-proof ping mechanism to see if something is still on the network. AWS does something similar with their guest OS reachability checks. Even if your system is blocking all inbound traffic it still has to respond to ARP requests for IP networking to basically work.

this post was submitted on 20 Nov 2023

1 points (100.0% liked)

Home Networking

358 readers

1 users here now

A community to help people learn, install, set up or troubleshoot their home network equipment and solutions.

Rules

Please stay on topic.
Please use the search function to look for keywords related to what you want to ask before posting since most common issues have been answered.
No Ads. This community is for support and discussion. Ads and self promotion are not welcome here.
No product reviews or announcements. If you have a question about a product, be specific about what you want to know.
Be civil. Don't be a jerk. Not being a jerk is surprisingly easy.
No URL shorteners. URL shorteners tend to hide the real use of a link. For this reason, please use normal links, even if they're long.
No affiliate links.
No gatekeeping. With profession shall come professionalism. Extend help without judging others for their ignorance. The same goes for downvoting of comments or posts for "stupid questions" or not being as knowledgeable as others.

founded 2 years ago

MODERATORS

communick@selfhosted.forum

rglullis@communick.news