dslreports logo
site
 
    All Forums Hot Topics Gallery
spc

spacer




how-to block ads


Search Topic:
uniqs
2822
share rss forum feed

Jurjen

join:2010-08-18
Montreal, QC

1 edit

[SOLVED] Ghost IP addresses in system log SpeedStream 5200

Hello everybody,

It's not something severe (I think), but I have a weird issue with my Speedstream 5200 modem.

When I look in the system log, it's flooded with this kind of entries:

2011-09-10 14:52:12 E I |ARP                  |IP Address 192.168.0.151 was not found
 

My local network is in the subnet 192.168.1.x, the WAN side of the router and the LAN side of the modem is in subnet 192.168.3.x (router has a fixed IP, DHCP in the modem is off). So it's pretty logical that the address can't be found: it doesn't excist.

Where could the requests for these non-existing addresses come from? It's creating quite some traffic, because sometimes every 2 seconds there's a new entry like that.

What's wrong here?

Thanks!


wayjac
Premium,MVM
join:2001-12-22
Indy
kudos:1

Re: Ghost IP addresses in system log SpeedStream 5200

said by Jurjen:

My local network is in the subnet 192.168.1.x

Ok
said by Jurjen:

The WAN side of the router and the LAN side of the modem is in subnet 192.168.3.x

Are you sure about this

What is the subnet mask of the modem

Most modems use arp to monitor it's lan devices

Jurjen

join:2010-08-18
Montreal, QC
reply to Jurjen

Yes I'm sure, otherwise I wouldn't be able to connect to connect to my modem.

The net mask set in the modem is 255.255.0.0

The modem is 192.168.3.1, the router's WAN is 192.168.3.2



wayjac
Premium,MVM
join:2001-12-22
Indy
kudos:1

said by Jurjen:

Yes I'm sure, otherwise I wouldn't be able to connect to connect to my modem

Sorry..........I overlooked the router.......
said by Jurjen:

The net mask set in the modem is 255.255.0.0

You should change the subnet mask to 255.255.255.0
If the subnet mask is 255.255.0.0 the entire range of 192.168.0.0 is a part of the modems subnet
If this change has no effect I would do a factory reset and reconfigure


Napsterbater
Meh
Premium,MVM
join:2002-12-28
Milledgeville, GA
Reviews:
·Windstream

said by wayjac:

said by Jurjen:

Yes I'm sure, otherwise I wouldn't be able to connect to connect to my modem

Sorry..........I overlooked the router.......
said by Jurjen:

The net mask set in the modem is 255.255.0.0

You should change the subnet mask to 255.255.255.0
If the subnet mask is 255.255.0.0 the entire range of 192.168.0.0 is a part of the modems subnet
If this change has no effect I would do a factory reset and reconfigure

Yeah change the Subnet Masks on the modem and router's WAN to 255.255.255.0, 192.168.0.151 is a valid address in that subnet, still strange why you seeing that.
--
ASUS M4A79T Deluxe | AMD Phenom II x3 720 BE AM3 w/4 Cores @ 3.41Ghz(OC) | 4Gb DDR3 Memory @ 1600mhz | Sapphire ATI HD4870 1GB 800mhz/1000mhz(OC) | 2x500GB HDD's Raid 0 | Windows 7 Ultimate x64 Build 7600 (RTM) | Windstream DSL 12m (14.9m Sync)/766k

Jurjen

join:2010-08-18
Montreal, QC
reply to Jurjen

I understand the address is/was valid under that subnet. The question was indeed (sorry if not properly formulated) where this came from. Who was demanding the address, why to the modem and no directly addressing the requested host by itself...?

I changed the subnet to 255.255.255.0, so far no new strange addresses in the system log.



wayjac
Premium,MVM
join:2001-12-22
Indy
kudos:1

said by Jurjen:

The question was indeed (sorry if not properly formulated) where this came from. Who was demanding the address, why to the modem and no directly addressing the requested host by itself...?

I can only speculate about the orgins of the arp request.........

Since it's in the modems log I think the modem is doing it......
Some modems use arp to keep track of dhcp/static clients [active or inactive]


Doctor Olds
I Need A Remedy For What's Ailing Me.
Premium,VIP
join:2001-04-19
1970 442 W30
kudos:18

said by wayjac:

Since it's in the modems log I think the modem is doing it......

100% correct. Some versions of firmware (Windstream firmware if I recall) do exactly that.
--
What’s the point of owning a supercar if you can’t scare yourself stupid from time to time?

Jurjen

join:2010-08-18
Montreal, QC
reply to Jurjen

As far as I can see, the firmware is from Efficient Networks.

After over 18 hours of uptime, no spooky IP addresses any more. Just the time server sync every hour (a bit much, but I can live with that).

Thanks for the help, guys!



Doctor Olds
I Need A Remedy For What's Ailing Me.
Premium,VIP
join:2001-04-19
1970 442 W30
kudos:18

What is the Firmware version?


Jurjen

join:2010-08-18
Montreal, QC

004-E240-A21
(Downloaded from a certain Brazilian website that most SS5200 users know.)



Doctor Olds
I Need A Remedy For What's Ailing Me.
Premium,VIP
join:2001-04-19
1970 442 W30
kudos:18

That is TelMex firmware.

Try FTP using user and password of telmex/telmex.


Jurjen

join:2010-08-18
Montreal, QC

Just tried it, but no response through IE.
Through my usual FTP client I can see FTP Server Ready and then 530 User name invalid.



Doctor Olds
I Need A Remedy For What's Ailing Me.
Premium,VIP
join:2001-04-19
1970 442 W30
kudos:18

Try Telnet instead.


Jurjen

join:2010-08-18
Montreal, QC

Telnet (through command prompt) gets connected. However, I'm not familiar with it at all. I could see some of the config (but a part flooded beyond what the screen could show).



Doctor Olds
I Need A Remedy For What's Ailing Me.
Premium,VIP
join:2001-04-19
1970 442 W30
kudos:18

Type ? and you will be given the basic commands, then you type each and their sub commands are seen.


Jurjen

join:2010-08-18
Montreal, QC

What I was afraid of, happened: accidental factory reset.

I'll stick with the GUI, makes more sense to me.