[177111] in North American Network Operators' Group
Re: Charter ARP Leak
daemon@ATHENA.MIT.EDU (David Coulson)
Mon Dec 29 12:57:06 2014
X-Original-To: nanog@nanog.org
Date: Mon, 29 Dec 2014 12:56:36 -0500
From: David Coulson <david@davidcoulson.net>
To: nanog@nanog.org
In-Reply-To: <11705148.752.1419875464156.JavaMail.root@benjamin.baylink.com>
Errors-To: nanog-bounces@nanog.org
On 12/29/14, 12:51 PM, Jay Ashworth wrote:
> Ok. But the interface to which the cablemodem is attached, in the general
> single-DHCP-IP case, is a /24, is it not?
I'm on TWC. The IP address I get from them is on a /20.
104.230.32.0/20 dev eth7 proto kernel scope link src 104.230.32.x
>
> The example Valdis posted had 5 or 6 different /24s from all over the v4
> address space; that seems exceptionally sloppy routing...
fw-1:/root # tcpdump -ni eth7 arp
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on eth7, link-type EN10MB (Ethernet), capture size 65535 bytes
12:54:21.354278 ARP, Request who-has 173.89.105.161 tell 173.89.96.1,
length 46
12:54:21.355881 ARP, Request who-has 104.230.27.232 tell 104.230.0.1,
length 46
We all knows it's easier to add another secondary IP to the interface
and add a new DHCP scope than to try to expand a subnet.
Not sure I understand what all the excitement is about?
