I've noticed something odd in the last few days. The internet activity light on my router has started flickering nonstop. I shrugged it off as someone in the house watching too much youtube or who knows what else. Anyhow this morning no one is here to use the internet and I still got the same amount of activity. Even with my laptop off, which I thought it was odd. It looked as if someone was flooding me. I thought perhaps my lnksys router got hacked or it auto-updated to a bad firmware.
So I decided to unplug the modem from the router and plug it to my laptop via ethernet. I changed my ethernet address on my laptop running ubuntu to a random one so just I wouldn't get the same ip/ipv6 address ( i don't know if that really works).
I launched wireshark and I got a flurry of arp requests of address that aren't even remotely within my ip range or subnet. Like who has 98.x.x.x tell 98.x.x.1, or who has 74.x.x.x tell 74.x.x.1. They all seem to be coming from Cadant_64:fe:46. The same deal with ipv6 addressess. I'm getting a lot of link local neighbour solicitations.
All in all, 2MB worth of capture within less then a minute. Is this normal?
Shouldn't the dhcp request be less frequent and narrower in ip space?
Edited to add topic group category. uid://455626
↧