Do broadcast ARPs count against bandwidth?

Alan G · 08-08-2005, 23:23

On a blueyonder 512k connection I see between 20 to 200+ packets per second all day due (I presume) to worm activity. Now this averages around 20k/sec throught the day and occasionally peaks over 100k sustained for a second. It's this traffic that keeps my modem light on almost constantly.

Question is does this count against my 512k? It seems to me it does. Even worse does it count against a cap on services such as ntl as this traffic is steadily increasing and already over a gig per month.

I'm quite happy for my modem light to flash the few times a minute a worm specifically targets my own IP but I'd rather not see the network arping every time the virus tries someone elses address. Especially if its eating my bandwidth.

Do ntl and telewest have any plans to filter this or am I just in a particularly noisy area?

Thanks.

The_real_dj · 09-08-2005, 00:42

As far as i know they dont, your bandwith allowance is (or should be) taken via your modems mac address. So rendom broadcasts should not get counted in your limit.
Just out of interest where are you seeing these packets???
I get quite a few logs on my firewall but 20 - 200 packets a sec seems mighty excessive.
Are the packets all comin from the same place etc?

PS: not sure if anyones said it, but welcome to Cable Forum

Alan G · 09-08-2005, 01:54

As they are broadcast packets not bound for my IP they don't get passed to the Windows IP stack by default. However they do show up with "netstat -e" (ethernet stats) from the command prompt. In my case non-unicast packets far exceed unicast packets by nearly 10:1

So I ran an ethernet monitor which identified the traffic as broadcast ARPs from the Blueyonder Cisco default gateway router. It's repeatedly looking for offline/unassigned addresses as worms seek out new hosts. Also makes me wonder what happens if I reply to these ARPs. Unless there is some additional filtering in the way I guess I become that IP address as far as Blueyonder is concerned.

I've checked the Cisco docs regarding cable networks (occasionally work in networking) and there's ways to avoid this ARP traffic ending up with customers but I guess Telewest haven't yet decided the problem is significant enough for the extra work to block it.

Note: My firewall doesn't see this traffic either as its dropped by the ethernet card before handing off to Windows because the IP address arp'd for doesn't match mine. It is there though and an ethernet monitor (the demo version of Traceplus Ethernet at www.sstinc.com will do if you want to try) easily identifies it. It puzzled me why my firewall only logged a few attacks per minute yet the modem light was on almost constantly. Now I know.

Thanks for the welcome.