登录
CSNA会员注册
找回密码
搜索
搜索
本版
用户
CSNA网络分析论坛
»
首页
›
流量分析
›
网络分析
›
这是我们公司用科来的网络抓包结果，希望大家给予帮助。 ...
返回列表
发帖
查看:
3438
|
回复:
19
这是我们公司用科来的网络抓包结果，希望大家给予帮助。
[复制链接]
acorp
acorp
当前离线
积分
0
发表于 2007-6-4 10:35:55
|
显示全部楼层
|
阅读模式
这是我公司网络抓包结果
编号 相对时间 源 目标 协议 大小 解码 概要
11 0.000000 00:14:38:B8:EB:AE
838 00:02:01.949528 00:11:09:09:26:62 FF:FF:FF:FF:FF:FF ARP 64 谁是 10.41.0.71? 告诉 10.41.1.71
839 00:02:01.949535 00:14:2A:A1:E9
9 FF:FF:FF:FF:FF:FF ARP 64 谁是 10.41.0.71? 告诉 10.41.0.128
840 00:02:01.949540 00:15:58
A
9:F4 FF:FF:FF:FF:FF:FF ARP 64 谁是 10.41.0.71? 告诉 10.41.0.22
841 00:02:01.949545 Foxconn:22:02:04 FF:FF:FF:FF:FF:FF ARP 64 谁是 10.41.0.71? 告诉 10.41.0.101
842 00:02:01.949550 00:14:78:3D:49:51 FF:FF:FF:FF:FF:FF ARP 64 谁是 10.41.0.71? 告诉 10.41.0.129
843 00:02:01.949555 00:19:21:FD:59:06 FF:FF:FF:FF:FF:FF ARP 64 谁是 10.41.0.71? 告诉 10.41.0.20
844 00:02:01.949560 00:11:09:FD:0B:87 FF:FF:FF:FF:FF:FF ARP 64 谁是 10.41.0.71? 告诉 10.41.0.163
845 00:02:01.949565 Sony Science Labs:04:E0:EC FF:FF:FF:FF:FF:FF ARP 64 谁是 10.41.0.71? 告诉 10.41.0.52
846 00:02:01.949572 Quantum Designs:F7:94:24 FF:FF:FF:FF:FF:FF ARP 64 谁是 10.41.0.71? 告诉 10.41.0.136
847 00:02:01.949577 00:11:09:FC:EC:12 FF:FF:FF:FF:FF:FF ARP 64 谁是 10.41.0.71? 告诉 10.41.0.98
848 00:02:01.949582 00:11:5B:80:7F
A FF:FF:FF:FF:FF:FF ARP 64 谁是 10.41.0.71? 告诉 10.41.1.118
849 00:02:01.949587 00:A1:B0:01:E4:AE FF:FF:FF:FF:FF:FF ARP 64 谁是 10.41.0.71? 告诉 10.41.0.158
850 00:02:01.949592 Compal Elec:04:31:AF FF:FF:FF:FF:FF:FF ARP 64 谁是 10.41.0.71? 告诉 10.41.0.44
851 00:02:01.949597 00:11:5B:C8:0F:05 FF:FF:FF:FF:FF:FF ARP 64 谁是 10.41.0.71? 告诉 10.41.0.186
852 00:02:01.949602 Micro-star:02:F3:F7 FF:FF:FF:FF:FF:FF ARP 64 谁是 10.41.0.71? 告诉 10.41.1.84
853 00:02:01.949607 00:11:11:1F
5:3E FF:FF:FF:FF:FF:FF ARP 64 谁是 10.41.0.71? 告诉 10.41.0.93
854 00:02:01.949611 00:19:21:A3:88:28 FF:FF:FF:FF:FF:FF ARP 64 谁是 10.41.0.71? 告诉 10.41.0.142
855 00:02:01.949617 IBM:86:70:9F FF:FF:FF:FF:FF:FF ARP 64 谁是 10.41.0.71? 告诉 10.41.0.207
856 00:02:01.949622 00:11:09:09:24:F0 FF:FF:FF:FF:FF:FF ARP 64 谁是 10.41.0.71? 告诉 10.41.0.151
857 00:02:01.949627 Micro-star:89:89:17 FF:FF:FF:FF:FF:FF ARP 64 谁是 10.41.0.71? 告诉 10.41.1.128
858 00:02:01.949632 Wistron:30:88:EE FF:FF:FF:FF:FF:FF ARP 64 谁是 10.41.0.71? 告诉 10.41.0.199
859 00:02:01.949637 Quantum Designs:F5:53:29 FF:FF:FF:FF:FF:FF ARP 64 谁是 10.41.0.71? 告诉 10.41.0.103
860 00:02:01.949642 00:13:D3:2E:EF:12 FF:FF:FF:FF:FF:FF ARP 64 谁是 10.41.0.71? 告诉 10.41.1.196
861 00:02:01.949647 Elitegroup:27:A1:1B FF:FF:FF:FF:FF:FF ARP 64 谁是 10.41.0.71? 告诉 10.41.0.46
862 00:02:01.949651 Elitegroup:64:CC:5D FF:FF:FF:FF:FF:FF ARP 64 谁是 10.41.0.71? 告诉 10.41.0.131
863 00:02:01.949656 00:14:38:B8:EB:AE FF:FF:FF:FF:FF:FF ARP 64 谁是 10.41.0.71? 告诉 10.41.0.135
864 00:02:01.949661 00:0E:7B:A2:95:08 FF:FF:FF:FF:FF:FF ARP 64 谁是 10.41.0.71? 告诉 10.41.0.170
865 00:02:01.949666 00:11:5B:EC:8F:66 FF:FF:FF:FF:FF:FF ARP 64 谁是 10.41.0.71? 告诉 10.41.0.144
866 00:02:01.949671 00:13:D3:22:7A:1E FF:FF:FF:FF:FF:FF ARP 64 谁是 10.41.0.71? 告诉 10.41.0.21
867 00:02:01.949676 Quantum Designs:B0:5F:6C FF:FF:FF:FF:FF:FF ARP 64 谁是 10.41.0.71? 告诉 10.41.0.39
868 00:02:01.949681 Realtek Semi:39:0D:DD FF:FF:FF:FF:FF:FF ARP 64 谁是 10.41.0.71? 告诉 10.41.0.213
869 00:02:01.949686 Intel:E5:E2:C2 FF:FF:FF:FF:FF:FF ARP 64 谁是 10.41.0.71? 告诉 10.41.0.126
870 00:02:01.949691 00:18:F3:4A:82:C9 FF:FF:FF:FF:FF:FF ARP 64 谁是 10.41.0.71? 告诉 10.41.0.61
871 00:02:01.949696 Twinhead:13:DC:9A FF:FF:FF:FF:FF:FF ARP 64 谁是 10.41.0.71? 告诉 10.41.0.42
872 00:02:01.949701 Quantum Designs:D4:73:A4 FF:FF:FF:FF:FF:FF ARP 64 谁是 10.41.0.71? 告诉 10.41.0.29
873 00:02:01.949706 00:0F:B0:96:47:1A FF:FF:FF:FF:FF:FF ARP 64 谁是 10.41.0.71? 告诉 10.41.0.110
874 00:02:01.949711 00:16:D3:39:55:1B FF:FF:FF:FF:FF:FF ARP 64 谁是 10.41.0.71? 告诉 10.41.0.115
875 00:02:01.949901 00:16:EC:DC:E4:E3 FF:FF:FF:FF:FF:FF ARP 64 谁是 10.41.0.71? 告诉 10.41.0.49
876 00:02:01.950572 00:11:09:B0:B3:AF FF:FF:FF:FF:FF:FF ARP 64 谁是 10.41.0.71? 告诉 10.41.0.150
878 00:02:01.953115 12:08:C2:63:10:58 FF:FF:FF:FF:FF:FF ARP 64 谁是 10.41.0.71? 告诉 10.41.0.211
879 00:02:01.953778 00:11:2F:35:60:22 FF:FF:FF:FF:FF:FF ARP 64 谁是 10.41.0.71? 告诉 10.41.0.153
880 00:02:01.953942 00:11:09:09:24:6C FF:FF:FF:FF:FF:FF ARP 64 谁是 10.41.0.71? 告诉 10.41.0.32
881 00:02:01.955277 Compal Elec:B6:F5:C9 FF:FF:FF:FF:FF:FF ARP 64 谁是 10.41.0.71? 告诉 10.41.0.95
882 00:02:01.956136 00:16:41:15:33:44 FF:FF:FF:FF:FF:FF ARP 64 谁是 10.41.0.71? 告诉 10.41.0.200
916 00:02:03.816867 Accton Tech:AA:1F:7F FF:FF:FF:FF:FF:FF ARP 64 谁是 10.41.1.2? 告诉 10.41.1.86
968 00:02:04.903009 Harbour Net:81:09:60 FF:FF:FF:FF:FF:FF ARP 82 谁是 10.41.1.10? 告诉 10.41.1.254
1004 00:02:10.954742 00:11:09:09:26:62 FF:FF:FF:FF:FF:FF ARP 64 谁是 10.41.0.113? 告诉 10.41.1.71
1005 00:02:10.954792 00:15:58:DA:D9:F4 FF:FF:FF:FF:FF:FF ARP 64 谁是 10.41.0.113? 告诉 10.41.0.22
1006 00:02:10.954800 00:14:2A:A1:E9:D9 FF:FF:FF:FF:FF:FF ARP 64 谁是 10.41.0.113? 告诉 10.41.0.128
1007 00:02:10.954810 Foxconn:22:02:04 FF:FF:FF:FF:FF:FF ARP 64 谁是 10.41.0.113? 告诉 10.41.0.101
1008 00:02:10.954846 00:19:21:FD:59:06 FF:FF:FF:FF:FF:FF ARP 64 谁是 10.41.0.113? 告诉 10.41.0.20
1009 00:02:10.954882 00:14:78:3D:49:51 FF:FF:FF:FF:FF:FF ARP 64 谁是 10.41.0.113? 告诉 10.41.0.129
1010 00:02:10.954889 00:11:09:FD:0B:87 FF:FF:FF:FF:FF:FF ARP 64 谁是 10.41.0.113? 告诉 10.41.0.163
1011 00:02:10.954896 00:11:09:FC:EC:12 FF:FF:FF:FF:FF:FF ARP 64 谁是 10.41.0.113? 告诉 10.41.0.98
1012 00:02:10.954902 Quantum Designs:F7:94:24 FF:FF:FF:FF:FF:FF ARP 64 谁是 10.41.0.113? 告诉 10.41.0.136
1013 00:02:10.954908 Sony Science Labs:04:E0:EC FF:FF:FF:FF:FF:FF ARP 64 谁是 10.41.0.113? 告诉 10.41.0.52
1014 00:02:10.954915 00:11:5B:C8:0F:05 FF:FF:FF:FF:FF:FF ARP 64 谁是 10.41.0.113? 告诉 10.41.0.186
1015 00:02:10.954921 Compal Elec:04:31:AF FF:FF:FF:FF:FF:FF ARP 64 谁是 10.41.0.113? 告诉 10.41.0.44
1016 00:02:10.954927 Micro-star:89:89:17 FF:FF:FF:FF:FF:FF ARP 64 谁是 10.41.0.113? 告诉 10.41.1.128
1017 00:02:10.954932 Elitegroup:64:CC:5D FF:FF:FF:FF:FF:FF ARP 64 谁是 10.41.0.113? 告诉 10.41.0.131
1018 00:02:10.954939 00:11:5B:80:7F:DA FF:FF:FF:FF:FF:FF ARP 64 谁是 10.41.0.113? 告诉 10.41.1.118
1019 00:02:10.954944 00:A1:B0:01:E4:AE FF:FF:FF:FF:FF:FF ARP 64 谁是 10.41.0.113? 告诉 10.41.0.158
1020 00:02:10.954950 00:13:D3:2E:EF:12 FF:FF:FF:FF:FF:FF ARP 64 谁是 10.41.0.113? 告诉 10.41.1.196
1021 00:02:10.954957 IBM:86:70:9F FF:FF:FF:FF:FF:FF ARP 64 谁是 10.41.0.113? 告诉 10.41.0.207
1022 00:02:10.954963 00:11:11:1F:D5:3E FF:FF:FF:FF:FF:FF ARP 64 谁是 10.41.0.113? 告诉 10.41.0.93
1023 00:02:10.954969 00:11:09:09:24:F0 FF:FF:FF:FF:FF:FF ARP 64 谁是 10.41.0.113? 告诉 10.41.0.151
1024 00:02:10.954976 Micro-star:02:F3:F7 FF:FF:FF:FF:FF:FF ARP 64 谁是 10.41.0.113? 告诉 10.41.1.84
1025 00:02:10.954983 00:19:21:A3:88:28 FF:FF:FF:FF:FF:FF ARP 64 谁是 10.41.0.113? 告诉 10.41.0.142
1026 00:02:10.954989 00:11:5B:EC:8F:66 FF:FF:FF:FF:FF:FF ARP 64 谁是 10.41.0.113? 告诉 10.41.0.144
1027 00:02:10.954996 Wistron:30:88:EE FF:FF:FF:FF:FF:FF ARP 64 谁是 10.41.0.113? 告诉 10.41.0.199
1028 00:02:10.955003 00:11:2F:35:60:22 FF:FF:FF:FF:FF:FF ARP 64 谁是 10.41.0.113? 告诉 10.41.0.153
1029 00:02:10.955022 00:0E:7B:A2:95:08 FF:FF:FF:FF:FF:FF ARP 64 谁是 10.41.0.113? 告诉 10.41.0.170
1030 00:02:10.955029 Quantum Designs:F5:53:29 FF:FF:FF:FF:FF:FF ARP 64 谁是 10.41.0.113? 告诉 10.41.0.103
1031 00:02:10.955035 00:13:D3:22:7A:1E FF:FF:FF:FF:FF:FF ARP 64 谁是 10.41.0.113? 告诉 10.41.0.21
1032 00:02:10.955041 Intel:E5:E2:C2 FF:FF:FF:FF:FF:FF ARP 64 谁是 10.41.0.113? 告诉 10.41.0.126
1033 00:02:10.955047 Elitegroup:27:A1:1B FF:FF:FF:FF:FF:FF ARP 64 谁是 10.41.0.113? 告诉 10.41.0.46
1034 00:02:10.955056 Quantum Designs:B0:5F:6C FF:FF:FF:FF:FF:FF ARP 64 谁是 10.41.0.113? 告诉 10.41.0.39
1035 00:02:10.955062 Quantum Designs:D4:73:A4 FF:FF:FF:FF:FF:FF ARP 64 谁是 10.41.0.113? 告诉 10.41.0.29
1036 00:02:10.955102 00:18:F3:4A:82:C9 FF:FF:FF:FF:FF:FF ARP 64 谁是 10.41.0.113? 告诉 10.41.0.61
1037 00:02:10.955143 12:08:C2:63:10:58 FF:FF:FF:FF:FF:FF ARP 64 谁是 10.41.0.113? 告诉 10.41.0.211
1038 00:02:10.955167 Twinhead:13:DC:9A FF:FF:FF:FF:FF:FF ARP 64 谁是 10.41.0.113? 告诉 10.41.0.42
1039 00:02:10.955231 00:0F:B0:96:47:1A FF:FF:FF:FF:FF:FF ARP 64 谁是 10.41.0.113? 告诉 10.41.0.110
1041 00:02:10.957670 00:16:D3:39:55:1B FF:FF:FF:FF:FF:FF ARP 64 谁是 10.41.0.113? 告诉 10.41.0.115
1042 00:02:10.957677 00:14:38:B8:EB:AE FF:FF:FF:FF:FF:FF ARP 64 谁是 10.41.0.113? 告诉 10.41.0.135
1043 00:02:10.957716 00:16:41:15:33:44 FF:FF:FF:FF:FF:FF ARP 64 谁是 10.41.0.113? 告诉 10.41.0.200
1044 00:02:10.960229 00:16:EC:DC:E4:E3 FF:FF:FF:FF:FF:FF ARP 64 谁是 10.41.0.113? 告诉 10.41.0.49
1045 00:02:10.960458 Compal Elec:B6:F5:C9 FF:FF:FF:FF:FF:FF ARP 64 谁是 10.41.0.113? 告诉 10.41.0.95
1046 00:02:10.960847 00:11:09:B0:B3:AF FF:FF:FF:FF:FF:FF ARP 64 谁是 10.41.0.113? 告诉 10.41.0.150
1047 00:02:10.962934 00:11:09:09:24:6C FF:FF:FF:FF:FF:FF ARP 64 谁是 10.41.0.113? 告诉 10.41.0.32
大家可以看到，这和平常的arp风暴不同，更像是基于arp的Dos攻击，但是被攻击的地址是随机的，即无法预测也没什么规律。我们去攻击的机器上检查也并没有看到什么异常，防病毒软件正常，其他也没什么很不正常的现象。所以想向各位论坛大侠求救，谢谢大家
回复
使用道具
举报
菜鸟人飞
菜鸟人飞
当前离线
积分
172
发表于 2007-6-4 10:46:31
|
显示全部楼层
1.
http://www.csna.cn/forum.php?mod ... &extra=page%3D1
2.上传数据包
回复
使用道具
举报
acorp
acorp
当前离线
积分
0
楼主
|
发表于 2007-6-4 11:01:48
|
显示全部楼层
拓扑结构为普通星形，监控主机是星形的一个端点，中心是二层交换机，无关键节点
本帖子中包含更多资源
您需要
登录
才可以下载或查看，没有账号？
CSNA会员注册
×
回复
使用道具
举报
zealotcc
zealotcc
当前离线
积分
8
发表于 2007-6-4 11:25:39
|
显示全部楼层
请楼主上传 工程文件
回复
使用道具
举报
acorp
acorp
当前离线
积分
0
楼主
|
发表于 2007-6-4 11:58:55
|
显示全部楼层
这是工程文件，谢谢大家
本帖子中包含更多资源
您需要
登录
才可以下载或查看，没有账号？
CSNA会员注册
×
回复
使用道具
举报
jeeyoo
jeeyoo
当前离线
积分
0
发表于 2007-6-4 13:51:49
|
显示全部楼层
最后还是没下下来工程文件。
我也遇到过类似问题。
我的原因是病毒，后来重装了系统，自动更新到最新。一切就好了 ‘
回复
使用道具
举报
osx1969
osx1969
当前离线
积分
0
发表于 2007-6-4 13:58:32
|
显示全部楼层
回复 #5 acorp 的帖子
工程1.RAR下不来！
回复
使用道具
举报
^_^!!橋橋
^_^!!橋橋
当前离线
积分
0
发表于 2007-6-4 14:02:14
|
显示全部楼层
........居然没遇到过这样的情况..
第一次见..还望解答....
回复
使用道具
举报
acorp
acorp
当前离线
积分
0
楼主
|
发表于 2007-6-4 14:57:22
|
显示全部楼层
重传工程文件，谢谢大家
本帖子中包含更多资源
您需要
登录
才可以下载或查看，没有账号？
CSNA会员注册
×
回复
使用道具
举报
dky198
dky198
当前离线
积分
0
发表于 2007-6-4 18:14:10
|
显示全部楼层
这象不象针对交换机的mac地址攻击呢？
回复
使用道具
举报
zealotcc
zealotcc
当前离线
积分
8
发表于 2007-6-4 19:26:17
|
显示全部楼层
你上传的两个数据包没有上面的那些ARP包.上面的那些的确是有问题
回复
使用道具
举报
55902000
55902000
当前离线
积分
1
发表于 2007-6-5 01:05:47
|
显示全部楼层
应该病毒生产ARP风暴吧...可能会影响你网络速度吧
回复
使用道具
举报
jeff_gx
jeff_gx
当前离线
积分
1
发表于 2007-6-5 09:16:00
|
显示全部楼层
我也遇到过这样的问题.大量的 谁是192.168.100.65告诉xxx.xxx.xxx.xxx.
有什么办法解决吗?
回复
使用道具
举报
acorp
acorp
当前离线
积分
0
楼主
|
发表于 2007-6-5 10:42:28
|
显示全部楼层
我上传的工程里，被攻击的是10.41.0.69和10.41.0.94啊，怎么说没有？
回复
使用道具
举报
zealotcc
zealotcc
当前离线
积分
8
发表于 2007-6-5 10:51:05
|
显示全部楼层
何以见得是攻击,两台机子有什么症状?
包没有做镜像,没有上图中明显的攻击迹象
[
本帖最后由 zealotcc 于 2007-6-5 10:52 编辑
]
回复
使用道具
举报
acorp
acorp
当前离线
积分
0
楼主
|
发表于 2007-6-5 11:47:53
|
显示全部楼层
839 00:01:11.593659 00:15:58
A
9:F4 FF:FF:FF:FF:FF:FF ARP 64 谁是 10.41.0.69? 告诉 10.41.0.22
840 00:01:11.593666 00:14:2A:A1:E9
9 FF:FF:FF:FF:FF:FF ARP 64 谁是 10.41.0.69? 告诉 10.41.0.128
841 00:01:11.593704 00:19:E0:01:06:2A FF:FF:FF:FF:FF:FF ARP 64 谁是 10.41.0.69? 告诉 10.41.0.145
842 00:01:11.593740 Foxconn:22:02:04 FF:FF:FF:FF:FF:FF ARP 64 谁是 10.41.0.69? 告诉 10.41.0.101
843 00:01:11.593747 00:19:21:FD:59:06 FF:FF:FF:FF:FF:FF ARP 64 谁是 10.41.0.69? 告诉 10.41.0.20
844 00:01:11.593776 00:11:5B:C8:03:7B FF:FF:FF:FF:FF:FF ARP 64 谁是 10.41.0.69? 告诉 10.41.1.82
845 00:01:11.593782 00:11:5B:80:7F
A FF:FF:FF:FF:FF:FF ARP 64 谁是 10.41.0.69? 告诉 10.41.1.118
846 00:01:11.593788 00:11:09:FC:EC:12 FF:FF:FF:FF:FF:FF ARP 64 谁是 10.41.0.69? 告诉 10.41.0.98
847 00:01:11.593794 00:A1:B0:01:E4:AE FF:FF:FF:FF:FF:FF ARP 64 谁是 10.41.0.69? 告诉 10.41.0.158
848 00:01:11.593800 Elitegroup:64:CC:5D FF:FF:FF:FF:FF:FF ARP 64 谁是 10.41.0.69? 告诉 10.41.0.131
849 00:01:11.593808 00:11:09:09:24:6C FF:FF:FF:FF:FF:FF ARP 64 谁是 10.41.0.69? 告诉 10.41.0.32
850 00:01:11.593814 Compal Elec:04:31:AF FF:FF:FF:FF:FF:FF ARP 64 谁是 10.41.0.69? 告诉 10.41.0.44
851 00:01:11.593821 00:11:2F:35:60:22 FF:FF:FF:FF:FF:FF ARP 64 谁是 10.41.0.69? 告诉 10.41.0.153
852 00:01:11.593827 Quantum Designs:F7:94:24 FF:FF:FF:FF:FF:FF ARP 64 谁是 10.41.0.69? 告诉 10.41.0.136
853 00:01:11.593834 Micro-star:A0:58:A2 FF:FF:FF:FF:FF:FF ARP 64 谁是 10.41.0.69? 告诉 10.41.0.157
854 00:01:11.593841 00:11:5B:C8:0F:05 FF:FF:FF:FF:FF:FF ARP 64 谁是 10.41.0.69? 告诉 10.41.0.186
855 00:01:11.593847 00:11:09:09:24:F0 FF:FF:FF:FF:FF:FF ARP 64 谁是 10.41.0.69? 告诉 10.41.0.151
856 00:01:11.593854 Micro-star:89:89:17 FF:FF:FF:FF:FF:FF ARP 64 谁是 10.41.0.69? 告诉 10.41.1.128
857 00:01:11.593861 Elitegroup:27:A1:1B FF:FF:FF:FF:FF:FF ARP 64 谁是 10.41.0.69? 告诉 10.41.0.46
858 00:01:11.593867 00:19:21:A3:88:28 FF:FF:FF:FF:FF:FF ARP 64 谁是 10.41.0.69? 告诉 10.41.0.142
859 00:01:11.593874 00:11:09:B0:B3:AF FF:FF:FF:FF:FF:FF ARP 64 谁是 10.41.0.69? 告诉 10.41.0.150
860 00:01:11.593881 00:13
3:2E:EF:12 FF:FF:FF:FF:FF:FF ARP 64 谁是 10.41.0.69? 告诉 10.41.1.196
861 00:01:11.593887 Quantum Designs:F5:53:29 FF:FF:FF:FF:FF:FF ARP 64 谁是 10.41.0.69? 告诉 10.41.0.103
862 00:01:11.593895 00:11:5B:EC:8F:66 FF:FF:FF:FF:FF:FF ARP 64 谁是 10.41.0.69? 告诉 10.41.0.144
863 00:01:11.593901 00:0E:7B:A2:95:08 FF:FF:FF:FF:FF:FF ARP 64 谁是 10.41.0.69? 告诉 10.41.0.170
864 00:01:11.593922 00:13:D3:22:7A:1E FF:FF:FF:FF:FF:FF ARP 64 谁是 10.41.0.69? 告诉 10.41.0.21
865 00:01:11.593928 Quantum Designs:B0:5F:6C FF:FF:FF:FF:FF:FF ARP 64 谁是 10.41.0.69? 告诉 10.41.0.39
866 00:01:11.593935 Realtek Semi:39:0D:DD FF:FF:FF:FF:FF:FF ARP 64 谁是 10.41.0.69? 告诉 10.41.0.213
867 00:01:11.593954 00:0F:B0:96:47:1A FF:FF:FF:FF:FF:FF ARP 64 谁是 10.41.0.69? 告诉 10.41.0.110
868 00:01:11.593961 Wistron:30:88:EE FF:FF:FF:FF:FF:FF ARP 64 谁是 10.41.0.69? 告诉 10.41.0.199
869 00:01:11.593991 00:18:F3:4A:82:C9 FF:FF:FF:FF:FF:FF ARP 64 谁是 10.41.0.69? 告诉 10.41.0.61
870 00:01:11.594008 Intel:E5:E2:C2 FF:FF:FF:FF:FF:FF ARP 64 谁是 10.41.0.69? 告诉 10.41.0.126
871 00:01:11.594014 Twinhead:13:DC:9A FF:FF:FF:FF:FF:FF ARP 64 谁是 10.41.0.69? 告诉 10.41.0.42
872 00:01:11.594055 00:14:38:B8:EB:AE FF:FF:FF:FF:FF:FF ARP 64 谁是 10.41.0.69? 告诉 10.41.0.135
873 00:01:11.595298 Quantum Designs:D4:73:A4 FF:FF:FF:FF:FF:FF ARP 64 谁是 10.41.0.69? 告诉 10.41.0.29
875 00:01:11.598962 Compal Elec:B6:F5:C9 FF:FF:FF:FF:FF:FF ARP 64 谁是 10.41.0.69? 告诉 10.41.0.95
876 00:01:11.602243 00:16:EC:DC:E4:E3 FF:FF:FF:FF:FF:FF ARP 64 谁是 10.41.0.69? 告诉 10.41.0.49
1056 00:01:50.371637 00:14:2A:A1:E9:D9 FF:FF:FF:FF:FF:FF ARP 64 谁是 10.41.0.94? 告诉 10.41.0.128
1057 00:01:50.371679 Foxconn:22:02:04 FF:FF:FF:FF:FF:FF ARP 64 谁是 10.41.0.94? 告诉 10.41.0.101
1058 00:01:50.371704 00:19:E0:01:06:2A FF:FF:FF:FF:FF:FF ARP 64 谁是 10.41.0.94? 告诉 10.41.0.145
1059 00:01:50.371741 00:19:21:FD:59:06 FF:FF:FF:FF:FF:FF ARP 64 谁是 10.41.0.94? 告诉 10.41.0.20
1060 00:01:50.371747 00:11:5B:C8:03:7B FF:FF:FF:FF:FF:FF ARP 64 谁是 10.41.0.94? 告诉 10.41.1.82
1061 00:01:50.371753 00:11:5B:80:7F:DA FF:FF:FF:FF:FF:FF ARP 64 谁是 10.41.0.94? 告诉 10.41.1.118
1062 00:01:50.371760 00:11:09:FC:EC:12 FF:FF:FF:FF:FF:FF ARP 64 谁是 10.41.0.94? 告诉 10.41.0.98
1063 00:01:50.371766 Quantum Designs:F7:94:24 FF:FF:FF:FF:FF:FF ARP 64 谁是 10.41.0.94? 告诉 10.41.0.136
1064 00:01:50.371772 00:A1:B0:01:E4:AE FF:FF:FF:FF:FF:FF ARP 64 谁是 10.41.0.94? 告诉 10.41.0.158
1065 00:01:50.371778 Compal Elec:04:31:AF FF:FF:FF:FF:FF:FF ARP 64 谁是 10.41.0.94? 告诉 10.41.0.44
1066 00:01:50.371784 00:11:09:09:24:F0 FF:FF:FF:FF:FF:FF ARP 64 谁是 10.41.0.94? 告诉 10.41.0.151
1067 00:01:50.371790 Elitegroup:64:CC:5D FF:FF:FF:FF:FF:FF ARP 64 谁是 10.41.0.94? 告诉 10.41.0.131
1068 00:01:50.371796 00:11:5B:C8:0F:05 FF:FF:FF:FF:FF:FF ARP 64 谁是 10.41.0.94? 告诉 10.41.0.186
1069 00:01:50.371802 Elitegroup:27:A1:1B FF:FF:FF:FF:FF:FF ARP 64 谁是 10.41.0.94? 告诉 10.41.0.46
1070 00:01:50.371808 Micro-star:89:89:17 FF:FF:FF:FF:FF:FF ARP 64 谁是 10.41.0.94? 告诉 10.41.1.128
1071 00:01:50.371814 Micro-star:A0:58:A2 FF:FF:FF:FF:FF:FF ARP 64 谁是 10.41.0.94? 告诉 10.41.0.157
1072 00:01:50.371821 00:19:21:A3:88:28 FF:FF:FF:FF:FF:FF ARP 64 谁是 10.41.0.94? 告诉 10.41.0.142
1073 00:01:50.371869 Intel:E5:E2:C2 FF:FF:FF:FF:FF:FF ARP 64 谁是 10.41.0.94? 告诉 10.41.0.126
1074 00:01:50.371875 00:0E:7B:A2:95:08 FF:FF:FF:FF:FF:FF ARP 64 谁是 10.41.0.94? 告诉 10.41.0.170
1075 00:01:50.371881 00:11:5B:EC:8F:66 FF:FF:FF:FF:FF:FF ARP 64 谁是 10.41.0.94? 告诉 10.41.0.144
1076 00:01:50.371888 00:13:D3:2E:EF:12 FF:FF:FF:FF:FF:FF ARP 64 谁是 10.41.0.94? 告诉 10.41.1.196
1077 00:01:50.371894 Twinhead:13:DC:9A FF:FF:FF:FF:FF:FF ARP 64 谁是 10.41.0.94? 告诉 10.41.0.42
1078 00:01:50.371900 00:11:2F:35:60:22 FF:FF:FF:FF:FF:FF ARP 64 谁是 10.41.0.94? 告诉 10.41.0.153
1079 00:01:50.371906 00:13:D3:22:7A:1E FF:FF:FF:FF:FF:FF ARP 64 谁是 10.41.0.94? 告诉 10.41.0.21
1080 00:01:50.371912 Quantum Designs:F5:53:29 FF:FF:FF:FF:FF:FF ARP 64 谁是 10.41.0.94? 告诉 10.41.0.103
1081 00:01:50.371918 00:18:F3:4A:82:C9 FF:FF:FF:FF:FF:FF ARP 64 谁是 10.41.0.94? 告诉 10.41.0.61
1082 00:01:50.371924 00:16:EC:DC:E4:E3 FF:FF:FF:FF:FF:FF ARP 64 谁是 10.41.0.94? 告诉 10.41.0.49
1083 00:01:50.371930 Wistron:30:88:EE FF:FF:FF:FF:FF:FF ARP 64 谁是 10.41.0.94? 告诉 10.41.0.199
1084 00:01:50.371936 00:14:38:B8:EB:AE FF:FF:FF:FF:FF:FF ARP 64 谁是 10.41.0.94? 告诉 10.41.0.135
1085 00:01:50.371942 Realtek Semi:39:0D:DD FF:FF:FF:FF:FF:FF ARP 64 谁是 10.41.0.94? 告诉 10.41.0.213
1086 00:01:50.371948 00:0F:B0:96:47:1A FF:FF:FF:FF:FF:FF ARP 64 谁是 10.41.0.94? 告诉 10.41.0.110
1087 00:01:50.371981 Quantum Designs:B0:5F:6C FF:FF:FF:FF:FF:FF ARP 64 谁是 10.41.0.94? 告诉 10.41.0.39
1088 00:01:50.372137 00:11:09:09:24:6C FF:FF:FF:FF:FF:FF ARP 64 谁是 10.41.0.94? 告诉 10.41.0.32
1089 00:01:50.372437 00:11:09:B0:B3:AF FF:FF:FF:FF:FF:FF ARP 64 谁是 10.41.0.94? 告诉 10.41.0.150
1090 00:01:50.374120 Quantum Designs:D4:73:A4 FF:FF:FF:FF:FF:FF ARP 64 谁是 10.41.0.94? 告诉 10.41.0.29
1091 00:01:50.376779 Compal Elec:B6:F5:C9 FF:FF:FF:FF:FF:FF ARP 64 谁是 10.41.0.94? 告诉 10.41.0.95
这还说明不了是攻击？短时间好像流量不大，长期累积对网络影响可不小，现在不论哪个机器访问公网时都慢得可以
回复
使用道具
举报
zealotcc
zealotcc
当前离线
积分
8
发表于 2007-6-5 14:36:01
|
显示全部楼层
你没有做镜像当然看到的都是广播包,看下你的NETBIOS包再比较下你的ARP包,这种大小的广播包完全是可以接受的,而你却固执的认为是ARP问题,抓包的方式是很有讲究的,而你凭一台机器上的流量就能判断整个网络的问题?
网络速度变慢的原因有很多,P2P之类的软件,设备问题等,通过科来的诊断里可以看到存在TCP重传 复位等情况,具体是什么造成的我也无法得知,建议从硬件检查起
[
本帖最后由 zealotcc 于 2007-6-5 15:01 编辑
]
回复
使用道具
举报
acorp
acorp
当前离线
积分
0
楼主
|
发表于 2007-6-5 15:03:36
|
显示全部楼层
谢谢你，你的意思是arp在我们的网络里并没有太多，或者至少从这一点的科来分析结果来说并没有足够的证据能证明，是吗？我们再想想办法，谢谢
回复
使用道具
举报
zealotcc
zealotcc
当前离线
积分
8
发表于 2007-6-5 17:44:20
|
显示全部楼层
论坛是大家讨论交流的地方,如果能帮lz解决问题我也会很开心
再补充一下抓包的问题,ARP协议对抓包的要求比较低,但是在网络故障中比较常见,所以一般包拿来不论哪抓的都可以找出问题.像lz这样的情况就得做镜像抓了.这样抓的包从数据上可以看出硬件是否负载过高,或者其他的问题
回复
使用道具
举报
fairyland
fairyland
当前离线
积分
0
发表于 2007-6-9 19:56:54
|
显示全部楼层
很好的例子,谢谢
回复
使用道具
举报
返回列表
发帖
高级模式
B
Color
Image
Link
Quote
Code
Smilies
您需要登录后才可以回帖
登录
|
CSNA会员注册
本版积分规则
发表回复
回帖并转播
回帖后跳转到最后一页
快速回复
返回顶部
返回列表
发表于 2007-6-4 10:35:55
9 FF:FF:FF:FF:FF:FF ARP 64 谁是 10.41.0.71? 告诉 10.41.0.128 
发表于 2007-6-4 10:46:31
