RVS1000 Router, not answering request

[Darrin Calcutt]

I have the following frame, being broadcasted on my network

0000   ff ff ff ff ff ff 9c 8e cd 05 5e bb 08 06 00 01  ..........^.....
0010   08 00 06 04 00 01 9c 8e cd 05 5e bb c0 a8 01 cc  ..........^.....
0020   00 00 00 00 00 00 c0 a8 01 0a 00 00 00 00 00 00  ................

AmcrestT_05:5e:bb Broadcast ARP 60 Who has 192.168.1.10? Tell 192.168.1.204

Frame 199: 60 bytes on wire (480 bits), 60 bytes captured (480 bits) on interface 0
Ethernet II, Src: AmcrestT_05:5e:bb (9c:8e:cd:05:5e:bb), Dst: Broadcast (ff:ff:ff:ff:ff:ff)
    Destination: Broadcast (ff:ff:ff:ff:ff:ff)
        Address: Broadcast (ff:ff:ff:ff:ff:ff)
        .... ..1. .... .... .... .... = LG bit: Locally administered address (this is NOT the factory default)
        .... ...1 .... .... .... .... = IG bit: Group address (multicast/broadcast)
    Source: AmcrestT_05:5e:bb (9c:8e:cd:05:5e:bb)
        Address: AmcrestT_05:5e:bb (9c:8e:cd:05:5e:bb)
        .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
        .... ...0 .... .... .... .... = IG bit: Individual address (unicast)
    Type: ARP (0x0806)
    Padding: 000000000000000000000000000000000000
Address Resolution Protocol (request)
    Hardware type: Ethernet (1)
    Protocol type: IPv4 (0x0800)
    Hardware size: 6
    Protocol size: 4
    Opcode: request (1)
    Sender MAC address: AmcrestT_05:5e:bb (9c:8e:cd:05:5e:bb)
    Sender IP address: 192.168.1.204
    Target MAC address: 00:00:00_00:00:00 (00:00:00:00:00:00)
    Target IP address: 192.168.1.10

Why is the router not respond to the resolution of the MAC address for the IP address?

Darrin

[Richard Burts · Accepted solution]

Darrin

The arp request is looking for the MAC address used by 192.168.1.10. I can not tell from your post whether that address is the router address or if the router address is something different.

HTH

Rick

[Darrin Calcutt]

192.168.1.10 is my router, yes.

192.168.1.200-204 is my security cameras.

the devices 192.168.1.200-204 are always asking.

So, I'm wandering if its the cameras, or the router.

[Richard Burts]

Darrin

Thank you for confirming that 192.168.1.10 is the router address and that 192.168.1.204 is a security camera. You say that the security cameras are always asking. Can you give us some specifics about how frequently 192.168.1.204 is asking? Some devices have very short timers on their ARP cache and can send arp requests pretty frequently because of this.

HTH

Rick

[Darrin Calcutt]

here is my screen. Does this help?

[Richard Burts]

Seeing that screen does help. In that capture do you find any packets that have 168.168.1.10 as the source address?

Can you tell us something about the topology of the network? Where are the security cameras connected?

HTH

Rick

[Darrin Calcutt]

Wow, where do I start?

192.168.1.10 router

192.168.1.12 access point in basement

192.168.1.13 access point in front room of house

192.168.1.14 access point in back of house

192.168.1.15 wireless client in attic (working on it)

192.168.1.16 access point in attic teathered to 192.168.1.15 (Working on it)

with six unmanaged switches

there are almost 60 devices on my network, about half are wireless.

Eventually there will be a total of 6 cameras on-line around my house, all teathered, for now, the two are wireless.

192.168.1.10 (Cisco VPN Router)

- MAC: 28:94:0f:f9:45:5a

- Vendor: Cisco Systems, Inc

- Properties: Pingable, UPNP, Gateway, Web interface

content was edited.

[Richard Burts]

Darrin

Thanks for lots of detail. But it does not really help me understand what is connected to what. So let me try a couple more specific questions.

- what is the camera at 192.168.1.204 connected to?

- which device performed the packet capture that is shown on your screen?

- does that packet capture show any traffic with the router 192.168.1.10 as the source?

HTH

Rick

[Darrin Calcutt]

192.168.1.204 is currently wireless, and can connect to any access point, based on the signal strength. And if one access point goes down, the devices should find the next access point. 192.168.12 or 192.168.1.13 or 192.168.1.14

The access points are all tethered to the router (and may be trough a unmanaged switch).

My computer is doing the capturing of packets 192.168.1.148

As for capturing packets at the source, I'm trying to make my computer clone 192.168.1.10 ip address, so that it will listen to all packets (as the router does)

Someone from the forum at Wireshark, is giving me more information on this.

[Richard Burts]

Darrin

Have the suggestions from the forum at Wireshark helped you make progress on this issue? I am not clear what you mean when you talk about making your computer clone 192.168.1.10. Can you clarify? And does the packet capture see any traffic with source address of the router 192.168.1.10?

HTH

Rick

[Darrin Calcutt]

using 192.148.1.148, It seems that I can only see public packets or packets to and from that address.

As 192.168.1.202 and 192.168.1.204 send a broadcast out, for the who had 192.168.1.10; I can see that. But I'm assuming that when 192.168.1.10 replies, it replies directly to 192.168.1.202 and 192.168.1.204, which I cannot see.

So not sure how I should get around this.

Either way, I'm puzzled why 192.168.1.202 and 192.168.1.204 request so many time and other devices I don't hear from that often.

[Richard Burts]

Depending on how the switch is configured it is quite likely that packet capture on your PC is limited to broadcast packets and packets to and from your PC. If the switch supports it one option would be to configure the switch port for a SPAN session. This would impact normal operation of your PC but would allow you to capture more traffic. Since doing that would be disruptive perhaps we should look for other alternatives to help us investigate. You describe the router as a Cisco vpn router. I am not clear what type of router it is and whether this router would support debug arp (or perhaps debug ip arp).

HTH

Rick

[Darrin Calcutt]

My Router is RVS4000 and all switches are SG1000-08 v1, all access points are WAP4410N units

[Richard Burts]

Darrin

Thanks for the details about the models of your equipment. the RVS4000 is not an IOS router and I am having some difficulty in finding documentation about whether it supports functions like debug arp. Your switch appears to be an unmanaged switch and so would not support configuring a span port which would have allowed your packet capture to capture packets to and from the router. So the steps that I would like to have taken in investigating this issue appear to not be available.   So let me try to go in a different direction. How are the cameras learning their IP addresses? Are they hard coded or are they learned using DHCP? If it is DHCP then where is the DHCP server?

HTH

Rick

[Darrin Calcutt]

Static IP addresses that I have assigned. for the two cameras.

The DHCP server, is my router, static also, 192.168.1.10