[prev in list] [next in list] [prev in thread] [next in thread]
List: wireshark-users
Subject: Re: [Wireshark-users] Help on data from wiresharck
From: Anne Blankert <anne.blankert () geodan ! nl>
Date: 2017-10-05 9:26:34
Message-ID: CAHmgCsZQRvZUW1emPdf8WH1vOTP3mY_H_SCOVLzGrpuBjBqBVQ () mail ! gmail ! com
[Download RAW message or body]
[Attachment #2 (multipart/alternative)]
I interpret
2336 191.200998 HuaweiTe_21:8d:a5 Broadcast ARP 60 Who has
169.254.88.123? Tell 192.168.1.111
as:
A network device, made by Huawei, is asking all machines connected to the
network for the MAC-address of machine with link-local ipv4 address
169.254.88.123.
The network device claims the answer should be sent to 192.168.1.111.
Normally, this means that the Huawei device is using ip 192.168.1.111.
For some reason device 192.168.1.111 tries to contact link-local
address 169.254.88.123.
This happens when the device is configured to contact link-local addresses
and something tries to contact the specified link-local address (
169.254.88.123).
If 192.168.1.111 is configured as gateway, the ARP request can happen if
either the gateway or some other device on the network wants to
contact 169.254.88.123
and forwards the packet to the gateway. If the gateway is configured to
lookup link-local addresses on the local network, then the gateway will
issue an ARP to discover the MAC address of that device.
Anne
2017-10-04 13:26 GMT+02:00 Guy Harris <guy@alum.mit.edu>:
> On Oct 4, 2017, at 4:07 AM, Antonio Bernabei <abernabei@otticabernabei.com>
> wrote:
>
> > But why there is
> >
> > HuaweiTe
> >
> > Is it a phone trying to connect to our lan?
>
> Not necessarily. "HuaweiTe" is short for "Huawei Technologies Co.", and
> Huawei offer servers:
>
> http://e.huawei.com/en/products/cloud-computing-dc/servers
>
> and storage equipment:
>
> http://e.huawei.com/en/products/cloud-computing-dc/storage
>
> and networking equipment:
>
> http://e.huawei.com/en/products/enterprise-networking/switches
>
> http://e.huawei.com/en/products/enterprise-networking/routers
>
> as well as telecommunications equipment. ("Te" isn't short for
> "telecommunications" or "telephone" or....)
> ____________________________________________________________
> _______________
> Sent via: Wireshark-users mailing list <wireshark-users@wireshark.org>
> Archives: https://www.wireshark.org/lists/wireshark-users
> Unsubscribe: https://www.wireshark.org/mailman/options/wireshark-users
> mailto:wireshark-users-request@wireshark.org?subject=
> unsubscribe
>
[Attachment #5 (text/html)]
<div dir="ltr">I interpret <div><br></div><div><span style="font-size:12.8px">2336 \
191.200998 HuaweiTe_21:8d:a5 Broadcast ARP 60 Who has \
169.254.88.123? Tell 192.168.1.111</span><br \
style="font-size:12.8px"></div><div><br></div><div>as:</div><div><br></div><div>A \
network device, made by Huawei, is asking all machines connected to the network for \
the MAC-address of machine with link-local ipv4 address <span \
style="font-size:12.8px">169.254.88.123. The network device claims the answer should \
be sent to </span><span style="font-size:12.8px">192.168.1.111. Normally, this means \
that the Huawei device is using ip </span><span \
style="font-size:12.8px">192.168.1.111.</span></div><div><span \
style="font-size:12.8px"><br></span></div><div><span style="font-size:12.8px">For \
some reason device </span><span style="font-size:12.8px">192.168.1.111 tries to \
contact link-local address </span><span style="font-size:12.8px">169.254.88.123. \
This happens when the device is configured to contact link-local addresses and \
something tries to contact the specified link-local address (</span><span \
style="font-size:12.8px">169.254.88.123).</span></div><div><span \
style="font-size:12.8px"><br></span></div><div><span style="font-size:12.8px">If \
192.168.1.111 is configured as gateway, the ARP request can happen if either the \
gateway or some other device on the network wants to contact </span><span \
style="font-size:12.8px">169.254.88.123 and forwards the packet to the gateway. If \
the gateway is configured to lookup link-local addresses on the local network, then \
the gateway will issue an ARP to discover the MAC address of that \
device.</span></div><div><span style="font-size:12.8px"><br></span></div><div><span \
style="font-size:12.8px">Anne</span></div></div><div class="gmail_extra"><br><div \
class="gmail_quote">2017-10-04 13:26 GMT+02:00 Guy Harris <span dir="ltr"><<a \
href="mailto:guy@alum.mit.edu" \
target="_blank">guy@alum.mit.edu</a>></span>:<br><blockquote class="gmail_quote" \
style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><span \
class="">On Oct 4, 2017, at 4:07 AM, Antonio Bernabei <<a \
href="mailto:abernabei@otticabernabei.com">abernabei@otticabernabei.com</a>> \
wrote:<br> <br>
> But why there is<br>
><br>
> HuaweiTe<br>
><br>
> Is it a phone trying to connect to our lan?<br>
<br>
</span>Not necessarily. "HuaweiTe" is short for "Huawei Technologies \
Co.", and Huawei offer servers:<br> <br>
<a href="http://e.huawei.com/en/products/cloud-computing-dc/servers" \
rel="noreferrer" target="_blank">http://e.huawei.com/en/<wbr>products/cloud-computing-dc/<wbr>servers</a><br>
<br>
and storage equipment:<br>
<br>
<a href="http://e.huawei.com/en/products/cloud-computing-dc/storage" \
rel="noreferrer" target="_blank">http://e.huawei.com/en/<wbr>products/cloud-computing-dc/<wbr>storage</a><br>
<br>
and networking equipment:<br>
<br>
<a href="http://e.huawei.com/en/products/enterprise-networking/switches" \
rel="noreferrer" target="_blank">http://e.huawei.com/en/<wbr>products/enterprise-<wbr>networking/switches</a><br>
<br>
<a href="http://e.huawei.com/en/products/enterprise-networking/routers" \
rel="noreferrer" target="_blank">http://e.huawei.com/en/<wbr>products/enterprise-<wbr>networking/routers</a><br>
<br>
as well as telecommunications equipment. ("Te" isn't short for \
"telecommunications" or "telephone" or....)<br> <div \
class="HOEnZb"><div class="h5">______________________________<wbr>______________________________<wbr>_______________<br>
Sent via: Wireshark-users mailing list <<a \
href="mailto:wireshark-users@wireshark.org">wireshark-users@wireshark.org</a><wbr>><br>
Archives: <a href="https://www.wireshark.org/lists/wireshark-users" \
rel="noreferrer" target="_blank">https://www.wireshark.org/<wbr>lists/wireshark-users</a><br>
Unsubscribe: <a href="https://www.wireshark.org/mailman/options/wireshark-users" \
rel="noreferrer" target="_blank">https://www.wireshark.org/<wbr>mailman/options/wireshark-<wbr>users</a><br>
mailto:<a href="mailto:wireshark-users-request@wireshark.org">wireshark-users-<wbr>r \
equest@wireshark.org</a>?subject=<wbr>unsubscribe</div></div></blockquote></div><br></div>
[Attachment #6 (text/plain)]
___________________________________________________________________________
Sent via: Wireshark-users mailing list <wireshark-users@wireshark.org>
Archives: https://www.wireshark.org/lists/wireshark-users
Unsubscribe: https://www.wireshark.org/mailman/options/wireshark-users
mailto:wireshark-users-request@wireshark.org?subject=unsubscribe
[prev in list] [next in list] [prev in thread] [next in thread]
Configure |
About |
News |
Add a list |
Sponsored by KoreLogic