A Broadband and ADSL forum. BroadbanterBanter

Welcome to BroadbanterBanter.

You are currently viewing as a guest which gives you limited access to view most discussions and other FREE features. By joining our free community you will have access to post topics, communicate privately with other members (PM), respond to polls, upload your own photos and access many other special features. Registration is fast, simple and absolutely free so please, join our community today.

Go Back   Home » BroadbanterBanter forum » Newsgroup Discussions » uk.telecom.broadband (UK broadband)
Site Map Home Register Authors List Search Today's Posts Mark Forums Read Web Partners

uk.telecom.broadband (UK broadband) (uk.telecom.broadband) Discussion of broadband services, technology and equipment as provided in the UK. Discussions of specific services based on ADSL, cable modems or other broadband technology are also on-topic. Advertising is not allowed.

Blueyonder broadcast traffic.



 
 
Thread Tools Display Modes
  #1  
Old August 7th 05, 03:10 PM posted to uk.telecom.broadband
Alan Greig
external usenet poster
 
Posts: 6
Default Blueyonder broadcast traffic.


On a Telewest Blueyonder link I see the data light on almost constantly.
Running an Ethernet monitor I see this traffic is a steady 10 - 30Kbps
and consists almost entirely of the default gateway Cisco router arping
for IP address which appear to be other Blueyonder end user PCs.

Is this normal? Should I really be seeing 20 to 50 broadcast ARP packets
per second at the consumer end of the Surfboad modem? Could I grab
someone else's IP address if I responded to the ARP? No I'm not going to
try but it does seem a bit strange to me to see all this traffic.

--
Alan Greig

  #2  
Old August 7th 05, 04:14 PM posted to uk.telecom.broadband
kraftee
external usenet poster
 
Posts: 1,069
Default Blueyonder broadcast traffic.

Alan Greig wrote:
On a Telewest Blueyonder link I see the data light on almost
constantly. Running an Ethernet monitor I see this traffic is a
steady 10 - 30Kbps and consists almost entirely of the default
gateway Cisco router arping for IP address which appear to be other
Blueyonder end user PCs.
Is this normal? Should I really be seeing 20 to 50 broadcast ARP
packets per second at the consumer end of the Surfboad modem? Could I
grab someone else's IP address if I responded to the ARP? No I'm not
going to try but it does seem a bit strange to me to see all this
traffic.


Can't say for Blueyonder but NTL was like that when I subscribed to them...


  #3  
Old August 7th 05, 05:10 PM posted to uk.telecom.broadband
Matt
external usenet poster
 
Posts: 9
Default Blueyonder broadcast traffic.

Unfortunately that's the way it works. DOCSIS is like ethernet - it
needs to ARP to get the MAC address. Problem is that worms scan ranges
and try to contact every IP which means you see ARP requests for devices
that are either not on or are not allocated.


Matt.

Alan Greig wrote:

On a Telewest Blueyonder link I see the data light on almost constantly.
Running an Ethernet monitor I see this traffic is a steady 10 - 30Kbps
and consists almost entirely of the default gateway Cisco router arping
for IP address which appear to be other Blueyonder end user PCs.

Is this normal? Should I really be seeing 20 to 50 broadcast ARP packets
per second at the consumer end of the Surfboad modem? Could I grab
someone else's IP address if I responded to the ARP? No I'm not going to
try but it does seem a bit strange to me to see all this traffic.

  #4  
Old August 7th 05, 07:45 PM posted to uk.telecom.broadband
Alan Greig
external usenet poster
 
Posts: 6
Default Blueyonder broadcast traffic.



Matt wrote:
Unfortunately that's the way it works. DOCSIS is like ethernet - it
needs to ARP to get the MAC address. Problem is that worms scan ranges
and try to contact every IP which means you see ARP requests for devices
that are either not on or are not allocated.


Surely it doesn't have to be this way though? As far as I can see this
is just making the configuration simpler for the cable company. In fact
I've had a quick scan through the Cisco docs and some details from other
cable companies and there are indeed solutions - mostly involving static
and dhcp learned MAC/IP mapping and/or ARP filtering/limiting (IOS cable
arp commands etc).

I guess this traffic counts towards my bandwidth and it's already 5-10
percent of a 512K link. Doesn't seem to me as if it would take much
effort to bring the network to its knees using ARP flooding attacks. Are
Telewest and NTL just crossing their fingers and praying?

--
Alan Greig

  #5  
Old August 7th 05, 11:40 PM posted to uk.telecom.broadband
Alan Greig
external usenet poster
 
Posts: 6
Default Blueyonder broadcast traffic.



I guess this traffic counts towards my bandwidth and it's already 5-10
percent of a 512K link. Doesn't seem to me as if it would take much
effort to bring the network to its knees using ARP flooding attacks. Are
Telewest and NTL just crossing their fingers and praying?


Answering my own question it seems that other limitations will likely
prevent a total flood but I guess I'd rather not see that traffic on my
port at all.

--
Alan Greig

  #6  
Old August 8th 05, 03:44 PM posted to uk.telecom.broadband
Big Boy UK :-\)
external usenet poster
 
Posts: 21
Default Blueyonder broadcast traffic.


"kraftee" [email protected]&die wrote in message
...

traffic.


Can't say for Blueyonder but NTL was like that when I subscribed to
them...


ntl are perfect in every way not one issue since connection, some peopl are
always unlucky arent they im afraid.



 




Currently Active Users Viewing This Thread: 1 (0 members and 1 guests)
 
Thread Tools
Display Modes

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

vB code is On
Smilies are On
[IMG] code is On
HTML code is Off
Forum Jump

Similar Threads
Thread Thread Starter Forum Replies Last Post
plusnet+ traffic shaping question paul uk.telecom.broadband (UK broadband) 2 July 14th 05 07:28 AM
DG824G - SSID broadcast off - but I can still see it via my adapter? Tony Walker uk.telecom.broadband (UK broadband) 8 December 10th 04 10:02 AM
Monitor traffic Peter Hewitt-Dutton uk.telecom.broadband (UK broadband) 2 April 7th 04 12:27 PM
Netgear WG602v2 SSID broadcast bof uk.telecom.broadband (UK broadband) 1 January 21st 04 12:19 PM


All times are GMT +1. The time now is 06:04 AM.


Powered by vBulletin® Version 3.6.4
Copyright ©2000 - 2019, Jelsoft Enterprises Ltd.Content Relevant URLs by vBSEO 2.4.0
Copyright 2004-2019 BroadbanterBanter.
The comments are property of their posters.