Our subnet is connected with other subnets with router.
Using wireshark I see some arp requests coming to ip addresses of our subnet from the router.
Such as
Broadcast ARP 60 Who has
10.162.3.172? Tell 10.162.0.1
Where 10.162.0.1 is the router.
I want to determine the source computer from other subnet, which sends this requests. How can I perform it?
UPD subnet is 10.162.0.3.172/24
But if ARP never crosses broadcast domain boundaries then how computers from other networks can know destination of the packets(destination physical address) ? Is it obtained from the arp-table of the router? And why could router send arp requests, except probing addresses in the lease range to see which of them are free?
Best Answer
The source of the request is the router; it's sending the request, not a device outside the subnet. ARP never crosses broadcast domain boundaries.
10.162.3.172is in the subnet, as far as the router is concerned, which means the subnet mask on the router is configured as/22or larger.