Cable Forum - View Single Post - Do broadcast ARPs count against bandwidth?

Alan G · 09-08-2005, 01:54

As they are broadcast packets not bound for my IP they don't get passed to the Windows IP stack by default. However they do show up with "netstat -e" (ethernet stats) from the command prompt. In my case non-unicast packets far exceed unicast packets by nearly 10:1

So I ran an ethernet monitor which identified the traffic as broadcast ARPs from the Blueyonder Cisco default gateway router. It's repeatedly looking for offline/unassigned addresses as worms seek out new hosts. Also makes me wonder what happens if I reply to these ARPs. Unless there is some additional filtering in the way I guess I become that IP address as far as Blueyonder is concerned.

I've checked the Cisco docs regarding cable networks (occasionally work in networking) and there's ways to avoid this ARP traffic ending up with customers but I guess Telewest haven't yet decided the problem is significant enough for the extra work to block it.

Note: My firewall doesn't see this traffic either as its dropped by the ethernet card before handing off to Windows because the IP address arp'd for doesn't match mine. It is there though and an ethernet monitor (the demo version of Traceplus Ethernet at www.sstinc.com will do if you want to try) easily identifies it. It puzzled me why my firewall only logged a few attacks per minute yet the modem light was on almost constantly. Now I know.

Thanks for the welcome.

09-08-2005, 01:54	#3
Alan G Inactive Join Date: Aug 2005 Posts: 3	Re: Do broadcast ARPs count against bandwidth? As they are broadcast packets not bound for my IP they don't get passed to the Windows IP stack by default. However they do show up with "netstat -e" (ethernet stats) from the command prompt. In my case non-unicast packets far exceed unicast packets by nearly 10:1 So I ran an ethernet monitor which identified the traffic as broadcast ARPs from the Blueyonder Cisco default gateway router. It's repeatedly looking for offline/unassigned addresses as worms seek out new hosts. Also makes me wonder what happens if I reply to these ARPs. Unless there is some additional filtering in the way I guess I become that IP address as far as Blueyonder is concerned. I've checked the Cisco docs regarding cable networks (occasionally work in networking) and there's ways to avoid this ARP traffic ending up with customers but I guess Telewest haven't yet decided the problem is significant enough for the extra work to block it. Note: My firewall doesn't see this traffic either as its dropped by the ethernet card before handing off to Windows because the IP address arp'd for doesn't match mine. It is there though and an ethernet monitor (the demo version of Traceplus Ethernet at www.sstinc.com will do if you want to try) easily identifies it. It puzzled me why my firewall only logged a few attacks per minute yet the modem light was on almost constantly. Now I know. Thanks for the welcome.