Re: Help on data from wiresharck

[Anne Blankert <anne.blankert () geodan nl>]

I interpret

2336    191.200998    HuaweiTe_21:8d:a5    Broadcast    ARP 60    Who has
169.254.88.123? Tell 192.168.1.111

as:

A network device, made by Huawei, is asking all machines connected to the
network for the MAC-address of machine with link-local ipv4 address
169.254.88.123.
The network device claims the answer should be sent to 192.168.1.111.
Normally, this means that the Huawei device is using ip 192.168.1.111.

For some reason device 192.168.1.111 tries to contact link-local
address 169.254.88.123.
This happens when the device is configured to contact link-local addresses
and something tries to contact the specified link-local address (
169.254.88.123).

If 192.168.1.111 is configured as gateway, the ARP request can happen if
either the gateway or some other device on the network wants to
contact 169.254.88.123
and forwards the packet to the gateway. If the gateway is configured to
lookup link-local addresses on the local network, then the gateway will
issue an ARP to discover the MAC address of that device.

Anne

2017-10-04 13:26 GMT+02:00 Guy Harris <guy () alum mit edu>:

> On Oct 4, 2017, at 4:07 AM, Antonio Bernabei <abernabei () otticabernabei com>
> wrote:
>
> > But why there is
> >
> > HuaweiTe
> >
> > Is it a phone trying to connect to our lan?
>
> Not necessarily.  "HuaweiTe" is short for "Huawei Technologies Co.", and
> Huawei offer servers:
>
>         http://e.huawei.com/en/products/cloud-computing-dc/servers
>
> and storage equipment:
>
>         http://e.huawei.com/en/products/cloud-computing-dc/storage
>
> and networking equipment:
>
>         http://e.huawei.com/en/products/enterprise-networking/switches
>
>         http://e.huawei.com/en/products/enterprise-networking/routers
>
> as well as telecommunications equipment.  ("Te" isn't short for
> "telecommunications" or "telephone" or....)
> ____________________________________________________________
> _______________
> Sent via:    Wireshark-users mailing list <wireshark-users () wireshark org>
> Archives:    https://www.wireshark.org/lists/wireshark-users
> Unsubscribe: https://www.wireshark.org/mailman/options/wireshark-users
>              mailto:wireshark-users-request () wireshark org?subject=
> unsubscribe
___________________________________________________________________________
Sent via:    Wireshark-users mailing list <wireshark-users () wireshark org>
Archives:    https://www.wireshark.org/lists/wireshark-users
Unsubscribe: https://www.wireshark.org/mailman/options/wireshark-users
             mailto:wireshark-users-request () wireshark org?subject=unsubscribe