[177105] in North American Network Operators' Group
Re: Charter ARP Leak
daemon@ATHENA.MIT.EDU (Rampley Jr, Jim F)
Mon Dec 29 12:15:57 2014
X-Original-To: nanog@nanog.org
From: "Rampley Jr, Jim F" <jim.rampley@charter.com>
To: "Valdis.Kletnieks@vt.edu" <Valdis.Kletnieks@vt.edu>, "Stephen R. Carter"
<stephen.carter@gltgc.org>
Date: Mon, 29 Dec 2014 11:12:34 -0600
In-Reply-To: <150444.1419871788@turing-police.cc.vt.edu>
Cc: "nanog@nanog.org" <nanog@nanog.org>
Errors-To: nanog-bounces@nanog.org
On 12/29/14, 10:49 AM, "Valdis.Kletnieks@vt.edu" <Valdis.Kletnieks@vt.edu>
wrote:
>On Mon, 29 Dec 2014 03:44:48 +0000, "Stephen R. Carter" said:
>> Here is a small excerpt I am seeing.
>>=20
>> 06:04:04.760869 In 00:21:a0:fb:53:d9 > ff:ff:ff:ff:ff:ff, ethertype
>>ARP (0x0806), length 60: arp who-has 97.85.59.219 tell 97.85.58.1
>> 06:04:04.761950 In 00:21:a0:fb:53:d9 > ff:ff:ff:ff:ff:ff, ethertype
>>ARP (0x0806), length 60: arp who-has 75.135.155.27 tell 75.135.152.1
>
>The interesting thing is that they're all .1 addresses. It's almost as if
>the one broadcast domain has at least 7 different address spaces on it.
Valdis, you are correct. What your seeing is caused by multiple IP blocks
being assigned to the same CMTS interface.
