Jurjen
join:2010-08-18
Montreal, QC Reviews:
 ·Acanac
 ·Bell Fibe
1 edit | [SOLVED] Ghost IP addresses in system log SpeedStream 5200Hello everybody,
It's not something severe (I think), but I have a weird issue with my Speedstream 5200 modem.
When I look in the system log, it's flooded with this kind of entries:
2011-09-10 14:52:12 E I |ARP |IP Address 192.168.0.151 was not found
My local network is in the subnet 192.168.1.x, the WAN side of the router and the LAN side of the modem is in subnet 192.168.3.x (router has a fixed IP, DHCP in the modem is off). So it's pretty logical that the address can't be found: it doesn't excist.
Where could the requests for these non-existing addresses come from? It's creating quite some traffic, because sometimes every 2 seconds there's a new entry like that.
What's wrong here?
Thanks! |
|
 wayjacPremium,MVM
join:2001-12-22
Indy | Re: Ghost IP addresses in system log SpeedStream 5200 said by Jurjen:My local network is in the subnet 192.168.1.x Oksaid by Jurjen:The WAN side of the router and the LAN side of the modem is in subnet 192.168.3.x Are you sure about this
What is the subnet mask of the modem
Most modems use arp to monitor it's lan devices |
|
Jurjen
join:2010-08-18
Montreal, QC | reply to Jurjen
Yes I'm sure, otherwise I wouldn't be able to connect to connect to my modem.
The net mask set in the modem is 255.255.0.0
The modem is 192.168.3.1, the router's WAN is 192.168.3.2 |
|
|
|
wayjacPremium,MVM
join:2001-12-22
Indy | said by Jurjen:Yes I'm sure, otherwise I wouldn't be able to connect to connect to my modem Sorry..........I overlooked the router.......said by Jurjen:The net mask set in the modem is 255.255.0.0 You should change the subnet mask to 255.255.255.0
If the subnet mask is 255.255.0.0 the entire range of 192.168.0.0 is a part of the modems subnet
If this change has no effect I would do a factory reset and reconfigure |
|
Reviews:
·Windstream
 ·VOIPo
| said by wayjac:said by Jurjen:Yes I'm sure, otherwise I wouldn't be able to connect to connect to my modem Sorry..........I overlooked the router.......said by Jurjen:The net mask set in the modem is 255.255.0.0 You should change the subnet mask to 255.255.255.0
If the subnet mask is 255.255.0.0 the entire range of 192.168.0.0 is a part of the modems subnet
If this change has no effect I would do a factory reset and reconfigure
Yeah change the Subnet Masks on the modem and router's WAN to 255.255.255.0, 192.168.0.151 is a valid address in that subnet, still strange why you seeing that.
--
ASUS M4A79T Deluxe | AMD Phenom II x3 720 BE AM3 w/4 Cores @ 3.41Ghz(OC) | 4Gb DDR3 Memory @ 1600mhz | Sapphire ATI HD4870 1GB 800mhz/1000mhz(OC) | 2x500GB HDD's Raid 0 | Windows 7 Ultimate x64 Build 7600 (RTM) | Windstream DSL 12m (14.9m Sync)/766k |
|
Jurjen
join:2010-08-18
Montreal, QC Reviews:
·Acanac
·Bell Fibe
| reply to Jurjen
I understand the address is/was valid under that subnet. The question was indeed (sorry if not properly formulated) where this came from. Who was demanding the address, why to the modem and no directly addressing the requested host by itself...?
I changed the subnet to 255.255.255.0, so far no new strange addresses in the system log. |
|
wayjacPremium,MVM
join:2001-12-22
Indy | said by Jurjen:The question was indeed (sorry if not properly formulated) where this came from. Who was demanding the address, why to the modem and no directly addressing the requested host by itself...? I can only speculate about the orgins of the arp request.........
Since it's in the modems log I think the modem is doing it......
Some modems use arp to keep track of dhcp/static clients [active or inactive] |
|
 Doctor OldsI Need A Remedy For What's Ailing Me.Premium,VIP
join:2001-04-19
1970 442 W30
kudos:18 | said by wayjac:Since it's in the modems log I think the modem is doing it......
100% correct. Some versions of firmware (Windstream firmware if I recall) do exactly that.
--
What’s the point of owning a supercar if you can’t scare yourself stupid from time to time? |
|
Jurjen
join:2010-08-18
Montreal, QC | reply to Jurjen
As far as I can see, the firmware is from Efficient Networks.
After over 18 hours of uptime, no spooky IP addresses any more. Just the time server sync every hour (a bit much, but I can live with that).
Thanks for the help, guys! |
|
Doctor OldsI Need A Remedy For What's Ailing Me.Premium,VIP
join:2001-04-19
1970 442 W30
kudos:18 | What is the Firmware version? |
|
Jurjen
join:2010-08-18
Montreal, QC | 004-E240-A21
(Downloaded from a certain Brazilian website that most SS5200 users know.) |
|
Doctor OldsI Need A Remedy For What's Ailing Me.Premium,VIP
join:2001-04-19
1970 442 W30
kudos:18 | That is TelMex firmware. 
Try FTP using user and password of telmex/telmex. |
|
Jurjen
join:2010-08-18
Montreal, QC | Just tried it, but no response through IE.
Through my usual FTP client I can see FTP Server Ready and then 530 User name invalid. |
|
Doctor OldsI Need A Remedy For What's Ailing Me.Premium,VIP
join:2001-04-19
1970 442 W30
kudos:18 | Try Telnet instead. |
|
Jurjen
join:2010-08-18
Montreal, QC | Telnet (through command prompt) gets connected. However, I'm not familiar with it at all. I could see some of the config (but a part flooded beyond what the screen could show). |
|
Doctor OldsI Need A Remedy For What's Ailing Me.Premium,VIP
join:2001-04-19
1970 442 W30
kudos:18 | Type ? and you will be given the basic commands, then you type each and their sub commands are seen. |
|
Jurjen
join:2010-08-18
Montreal, QC | What I was afraid of, happened: accidental factory reset. 
I'll stick with the GUI, makes more sense to me.  |
|
