[ previous ] [ next ] [ threads ]
 From:  "James W. McKeand" <james at mckeand dot biz>
 To:  <m0n0wall at lists dot m0n0 dot ch>
 Subject:  RE: [m0n0wall] tracking down ip
 Date:  Thu, 26 Jan 2006 09:34:32 -0600
sai wrote:
> On 1/26/06, James W. McKeand <james at mckeand dot biz> wrote:
>> Kamil dot Wencel at hvbpensionsfonds dot de wrote:
>>> Hi sai,
>>> this IP looks like Microsofts default IP if your Windows Client
>>> is not able to get an IP via DHCP. I have no idea why MS picked
>>> that IP, but it looks strangely familiar.
>> It is the IP used for Automatic Private IP Addressing. Check your
>> DHCP - it may be off-line or have a stopped service.
>> MS did not pick the subnet for Automatic Private IP Addressing. IANA*
>> reserved the range - for Automatic
>> Private IP Addressing. Any OS that is able to automatically assign
>> an IP address when DHCP fails will use this range - MacOS also uses
>> that range. 
>> _________________________________
>> James W. McKeand
> ok, makes sense. Thanks!
> But why is this ip not coming up on the ARP table? Does the ARP table
> only pick up IPs within 'correct' subnets?

I believe (someone correct me) that there will only be an entry in the
ARP table if a connection was established between the client and the
m0n0wall. A UDP Broadcast is not a connection. The entry shows up in the
logs, but that is just because something unusual has occurred (a machine
is broadcasting on a different subnet than the m0n0wall LAN subnet)

James W. McKeand