I have a Linux server at home (OL 6.6, fwiw) running some internal services. I noticed this morning that it is responding to ARP requests for an address I see no record of.
The IP is not configured in any /etc/sysconfig/network-scripts
files, and does not show up in ip addr show
.
From my workstation:
macbook:~ elliott$ arping -c1 192.168.50.108
ARPING 192.168.50.108
60 bytes from 00:24:81:05:c0:cb (192.168.50.108): index=0 time=1.854 msec
--- 192.168.50.108 statistics ---
1 packets transmitted, 1 packets received, 0% unanswered (0 extra)
rtt min/avg/max/std-dev = 1.854/1.854/1.854/0.000 ms
macbook:~ elliott$
On the server:
[elliott@server ~]$ ifconfig | grep -i 00:24:81:05:C0:CB
br0 Link encap:Ethernet HWaddr 00:24:81:05:C0:CB
br0:1 Link encap:Ethernet HWaddr 00:24:81:05:C0:CB
eth0 Link encap:Ethernet HWaddr 00:24:81:05:C0:CB
[elliott@server ~]$
[elliott@server ~]$ ip addr | grep 192.168.50.108
[elliott@server ~]$
This IP is in the DHCP range on my router, fwiw, and does not respond to pings or any TCP requests in the normal port ranges (nmap -T4 -Pn 192.168.50.108
).
I've tried:
- Shutting down the server to confirm the ARP replies stop
- Shutting down services one by one and killing all unnecessary processes -- the IP does not stop responding until I shut down the computer (it is also one of the first IPs to come up when powered on)
- Changing the default gateway to point to a raspberry pi box and capture any network traffic with that IP -- I have not seen any
So my questions are a) how worried should I be? and b) what can/should I do to try to track this down?
Thanks for any help!