[Android Q&A, Help & Troubleshooting] ovlua:
Hi,

at work I'm monitoring the network with arpwatch.

Excerpt from the man-page:

Arpwatch keeps track for ethernet/ip address pairings. It syslogs activity and reports certain changes via email. Arpwatch uses pcap(3) to listen for arp packets on a local ethernet interface.

I get an email for every new ip address that is seen by arpwatch.

Emails looking like this:

From: arpwatch

Subject: new station (10.203.103.212) eth0

hostname: <unknown>

ip address: 10.203.103.212

interface: eth0

ethernet address: 11:22:33:44:55:66

ethernet vendor: <unknown>

timestamp: Friday, November 9, 2012 12:08:23 +0100

The problem arises after I conneted my android phone to our wifi network. Because there's no DHCP-Server I had to set a static ip for my android phone. I noticed after I connected my android phone to our wifi network, sometimes I get an email from arpwatch, telling me detection of a new ip address with MAC address of the android phone. The detected ip address was not part of our ip address range and was not the ip address I had set. I ignored this issue a long time. But since some other kollegues also using the wifi network with their android phones the number of email alerts increases dramatically.

I've seen this happen with different devices and also different android OS.

Huawei Ideos X3 with Android 2.3.2

Samsung Galaxy S2 Android 4.0.4

Samsung Galaxy S3 Android 4.1.1

Samsung Nexus S Android 4.1.2

To make this clear, it happens sometimes not everytime!

I tried to find out whats happening using tcpdump. Wifi on the android phone was switched off, tcpdump was started and wifi was switched on again. The ip and mac addresses are modified.

static ip android phone: 10.0.0.100

mac address android phone: 11:22:33:44:55:66

ip address default gateway: 10.0.0.1

This is the output if an new ip address(10.202.255.81) is detected.

# tcpdump -s 0 -n ether host 11:22:33:44:55:66

tcpdump: verbose output suppressed, use -v or -vv for full protocol decode

listening on eth0, link-type EN10MB (Ethernet), capture size 65535 bytes

11:05:49.322956 11:22:33:44:55:66 > ff:ff:ff:ff:ff:ff Null Supervisory, Receiver not Ready, rcv seq 64, Flags [Poll], length 46

11:05:50.152120 IP 0.0.0.0.68 > 255.255.255.255.67: BOOTP/DHCP, Request from 11:22:33:44:55:66, length 305

11:05:50.152445 IP 0.0.0.0.68 > 255.255.255.255.67: BOOTP/DHCP, Request from 11:22:33:44:55:66, length 300

11:05:50.277664 ARP, Request who-has 10.0.0.100 tell 0.0.0.0, length 46

11:05:50.692276 IP6 :: > ff02::16: HBH ICMP6, multicast listener report v2, 1 group record(s), length 28

11:05:50.855575 IP6 :: > ff02::16: HBH ICMP6, multicast listener report v2, 1 group record(s), length 28

11:05:51.281477 IP6 :: > ff02::1:ff05:9fb0: ICMP6, neighbor solicitation, who has fe80::7ad6:f0ff:fe05:9fb0, length 24

11:05:51.283056 ARP, Request who-has 10.0.0.1 tell 10.202.255.81, length 46

11:05:51.458239 ARP, Request who-has 10.0.0.100 tell 0.0.0.0, length 46

11:05:52.292968 IP6 fe80::7ad6:f0ff:fe05:9fb0 > ff02::2: ICMP6, router solicitation, length 16

11:05:52.293532 ARP, Request who-has 10.0.0.1 tell 10.0.0.100, length 46

11:05:52.968778 IP 10.0.0.100 > 224.0.0.22: igmp v3 report, 1 group record(s)

11:05:53.017242 ARP, Request who-has 10.0.0.100 tell 0.0.0.0, length 46

11:05:55.363517 ARP, Request who-has 10.0.0.100 tell 10.0.0.100, length 46

11:05:56.296858 IP6 fe80::7ad6:f0ff:fe05:9fb0 > ff02::2: ICMP6, router solicitation, length 16

11:05:57.371054 ARP, Request who-has 10.0.0.100 tell 10.0.0.100, length 46

11:06:00.313200 IP6 fe80::7ad6:f0ff:fe05:9fb0 > ff02::2: ICMP6, router solicitation, length 16

This is the output if NO new ip address ist detected.

# tcpdump -s 0 -n ether host 11:22:33:44:55:66

tcpdump: verbose output suppressed, use -v or -vv for full protocol decode

listening on eth0, link-type EN10MB (Ethernet), capture size 65535 bytes

11:32:33.778219 11:22:33:44:55:66 > ff:ff:ff:ff:ff:ff Null Supervisory, Receiver not Ready, rcv seq 64, Flags [Poll], length 46

11:32:33.982916 IP 0.0.0.0.68 > 255.255.255.255.67: BOOTP/DHCP, Request from 11:22:33:44:55:66, length 300

11:32:34.252228 IP 0.0.0.0.68 > 255.255.255.255.67: BOOTP/DHCP, Request from 11:22:33:44:55:66, length 305

11:32:37.819054 IP 0.0.0.0.68 > 255.255.255.255.67: BOOTP/DHCP, Request from 11:22:33:44:55:66, length 300

11:32:37.953531 IP 0.0.0.0.68 > 255.255.255.255.67: BOOTP/DHCP, Request from 11:22:33:44:55:66, length 305

11:32:37.966908 ARP, Request who-has 10.0.0.100 tell 0.0.0.0, length 46

11:32:38.888616 IP 10.0.0.100 > 224.0.0.22: igmp v3 report, 1 group record(s)

11:32:38.904096 IP6 :: > ff02::16: HBH ICMP6, multicast listener report v2, 1 group record(s), length 28

11:32:39.493975 ARP, Request who-has 10.0.0.1 tell 10.0.0.100, length 46

11:32:39.720875 ARP, Request who-has 10.0.0.100 tell 0.0.0.0, length 46

11:32:39.740019 IP6 :: > ff02::1:ff05:9fb0: ICMP6, neighbor solicitation, who has fe80::7ad6:f0ff:fe05:9fb0, length 24

11:32:40.751811 IP6 fe80::7ad6:f0ff:fe05:9fb0 > ff02::2: ICMP6, router solicitation, length 16

11:32:41.119021 ARP, Request who-has 10.0.0.100 tell 0.0.0.0, length 46

11:32:43.580411 ARP, Request who-has 10.0.0.100 tell 10.0.0.100, length 46

11:32:44.747895 IP6 fe80::7ad6:f0ff:fe05:9fb0 > ff02::2: ICMP6, router solicitation, length 16

11:32:45.581707 ARP, Request who-has 10.0.0.100 tell 10.0.0.100, length 46

11:32:48.646315 IP6 fe80::7ad6:f0ff:fe05:9fb0 > ff02::16: HBH ICMP6, multicast listener report v2, 1 group record(s), length 28

11:32:48.763368 IP6 fe80::7ad6:f0ff:fe05:9fb0 > ff02::2: ICMP6, router solicitation, length 16

The difference between both outputs is the ARP Request for the default gateway.

How can I get rid off the problem?

BTW: Why are there BOOTP/DHCP requests? I've set the ip address static!

Thanks for your help

Uwe