Realizm

Lately I've been getting sporadic moments of humongous lag over my internet connection and I got the idea that I might be able to figure out where some of that is coming from if I installed Ethereal. Now I don't know anything about packet analyzers or sniffers or capturing but I am pretty sure it picks up Every Single thing that goes in and out of my computer's internet connection. Right?


As soon as I start it up and begin capturing, I get a whole lot of broadcasts over the ARP protocol. Ethereal explains them as "Who 65.xx.xx.xx?" "Tell xx.xx.xx.xx" A lot of times the Tell is the IP for what I think is..whatever my modem connects to. I know this isn't a lot of info, sorry. Anyway, most of the Who IP addresses are those in the same uh, whatever as Me (i.e. 65.0.0.xx) is what changes. Sometimes it's a different IP altogether..

Are these ARP broadcast who/tells normal? I got to wondering if someone was sniffing the packets between my computer because I searched some stuff up about this that said something about MiM attacks through ARP requests and setting up the fake addresses, etc.


This kind of thing makes me really uncomfortable because I do'nt know what it means. If anybody has some links that kind of give a rundown of what I'm seeing that would be great.

Many of the target's MAC addresses are listed as Target MAC address: 00:00:00:00:00:00 (00:00:00_00:00:00). Is this normal? So that somebody doesn't know the physical location of a computer? I know these are a lot of questions that most people probably don't want to spend time answering.. so if somebody knows a site that can explain this..

charliex

All the things you mentioned are normal.

ARP is address resolution protocol, it just gets the addresses of tcp/ip based machines on a broadcast based network.

typically anything thats all 0's is a broadcast address, ie goes to everyone on the local net

Realizm

Thanks. Feelin' relieved now.