Hi Jim, No problem with that. Otherwise, the ARP would be for the default gateway address for remote segments (based on the routing table). Thanks! Tom Thomas W Shinder www.isaserver.org/shinder ISA 2004 Beta - Get it now! http://www.microsoft.com/isaserver/beta/default.asp ISA Server and Beyond: http://tinyurl.com/1jq1 Configuring ISA Server: http://tinyurl.com/1llp -----Original Message----- From: Jim Harrison [mailto:jim@xxxxxxxxxxxx] Sent: Thursday, April 15, 2004 8:57 AM To: [ISAserver.org Discussion List] Subject: [isalist] Re: ISA 2000 ARP Broadcasts? http://www.ISAserver.org Hi Tom, Correct, but I was trying to point out that Sindows will only ARP what it believes to be "local", since ARP is limited to Ethernet-local segments... Jim Harrison MCP(NT4, W2K), A+, Network+, PCG http://isaserver.org/Jim_Harrison/ http://isatools.org Read the help / books / articles! On Wed, 14 Apr 2004 09:45:52 -0500 "Thomas W Shinder" <tshinder@xxxxxxxxxxx> wrote: http://www.ISAserver.org Hi Jim, It think it will arp just for addresses that it needs to communicate with. What's really strange is that these stop when the Web Proxy service is disabled. Time for me to read up again on Windows arp behavior :) Thomas W Shinder www.isaserver.org/shinder ISA 2004 Beta - Get it now! http://www.microsoft.com/isaserver/beta/default.asp ISA Server and Beyond: http://tinyurl.com/1jq1 Configuring ISA Server: http://tinyurl.com/1llp -----Original Message----- From: Jim Harrison [mailto:jim@xxxxxxxxxxxx] Sent: Wednesday, April 14, 2004 9:37 AM To: [ISAserver.org Discussion List] Subject: [isalist] Re: ISA 2000 ARP Broadcasts? http://www.ISAserver.org What does ipconfig/all at the ISA produce? Windows aill arp any IP that it believes to be in its local segment. Jim Harrison MCP(NT4, W2K), A+, Network+, PCG http://isaserver.org/Jim_Harrison/ http://isatools.org Read the help / books / articles! On Wed, 14 Apr 2004 09:07:28 -0500 "DL.ISA" <ISA.Discussion@xxxxxxxxxxxxxxxxxxx> wrote: http://www.ISAserver.org Glad Joseph was able to get an answer to his hijacked thread. Now, anyone have an answer for the original poster (me?) H.323 is not enabled. The arp requests do not appear to be looking for any specific MAC. Packets coming across in this manner: Packetyzer Trace: Frame 122 (60 bytes on wire, 60 bytes captured) Frame is marked: False Arrival Time: Apr 14, 2004 08:54:50.775694000 Time delta from previous packet: 0.050069000 seconds Time since reference or first frame: 4.456430000 seconds Frame Number: 122 Packet Length: 60 bytes Capture Length: 60 bytes Ethernet II, Src: 00:06:5b:c0:81:69, Dst: ff:ff:ff:ff:ff:ff Destination: ff:ff:ff:ff:ff:ff (Broadcast) Source: 00:06:5b:c0:81:69 (DellComp_c0:81:69) Source or Destination Address: ff:ff:ff:ff:ff:ff (Broadcast) Source or Destination Address: 00:06:5b:c0:81:69 (DellComp_c0:81:69) Type: ARP (0x0806) Trailer: 00000000000000000000000000000000... Address Resolution Protocol (request) Hardware type: Ethernet (0x0001) Protocol type: IP (0x0800) Hardware size: 6 Protocol size: 4 Opcode: request (0x0001) Sender MAC address: 00:06:5b:c0:81:69 (DellComp_c0:81:69) Sender IP address: 172.16.5.50 (172.16.5.50) Target MAC address: 00:00:00:00:00:00 (00:00:00_00:00:00) Target IP address: 172.16.142.187 (172.16.142.187) 0000: FF FF FF FF FF FF 00 06 5B C0 81 69 08 06 00 01 ........[..i.... 0010: 08 00 06 04 00 01 00 06 5B C0 81 69 AC 10 05 32 ........[..i...2 0020: 00 00 00 00 00 00 AC 10 8E BB 00 00 00 00 00 00 ................ 0030: 00 00 00 00 00 00 00 00 00 00 00 00 ............ Any help tracking this down would help. When I stop the web proxy service, the requests stop. Thank you, Mitchell D. Lawrence Director, Network Administrator IT&S Department North Bay Hospital 1711 W. Wheeler Ave Aransas Pass, TX 78336 ph: (361) 758-0580 fx: (361) 758-0581 pg: (361) 270-0421 Mitchell.Lawrence@xxxxxxxxx gecko@xxxxxxxxxxxx (home) **< Good | Cheap | Fast > (Pick Two)** -----Original Message----- From: Troy Radtke [mailto:TRadtke@xxxxxxxxxxxx] Posted At: Tuesday, April 13, 2004 4:50 PM Posted To: ~ISA Discussion~ Conversation: [isalist] Re: ISA 2000 ARP Broadcasts? Subject: [isalist] Re: ISA 2000 ARP Broadcasts? http://www.ISAserver.org Dang H.323 dumping multicast onto the network!!!! Evil I tell you!!!! EEEEEVVVVVIIIILLLL....... *remembers that poor little hub that burnt out it's collision lights....* Troy -----Original Message----- From: Thomas W Shinder [mailto:tshinder@xxxxxxxxxxx] Sent: Tuesday, April 13, 2004 4:31 PM To: [ISAserver.org Discussion List] Subject: [isalist] Re: ISA 2000 ARP Broadcasts? http://www.ISAserver.org Hey guys, Good one: http://www.cisco.com/warp/public/788/voip/understand-gatekeepers.html HTH, Tom Thomas W Shinder www.isaserver.org/shinder ISA 2004 Beta - Get it now! http://www.microsoft.com/isaserver/beta/default.asp ISA Server and Beyond: http://tinyurl.com/1jq1 Configuring ISA Server: http://tinyurl.com/1llp -----Original Message----- From: Jim Harrison [mailto:jim@xxxxxxxxxxxx] Sent: Tuesday, April 13, 2004 4:12 PM To: [ISAserver.org Discussion List] Subject: [isalist] Re: ISA 2000 ARP Broadcasts? http://www.ISAserver.org Neat trick: - disable the H.323 Application Filter and watch the multicast broadcasts stop. Jim Harrison MCP(NT4, W2K), A+, Network+, PCG http://www.microsoft.com/isaserver http://isaserver.org/Jim_Harrison http://isatools.org Read the help, books and articles! ----- Original Message ----- From: "cismic" <cismic@xxxxxxx> To: "[ISAserver.org Discussion List]" <isalist@xxxxxxxxxxxxx> Sent: Tuesday, April 13, 2004 13:44 Subject: [isalist] Re: ISA 2000 ARP Broadcasts? http://www.ISAserver.org MessageNo, I don't have any multi-cast applications on any of my machines. And, that's what I find strange. I wonder if I should turn this off in bios? Thank you, Joseph ----- Original Message ----- From: Troy Radtke To: [ISAserver.org Discussion List] Sent: Tuesday, April 13, 2004 1:32 PM Subject: [isalist] Re: ISA 2000 ARP Broadcasts? http://www.ISAserver.org Do you have multicast applications at all? -----Original Message----- From: cismic [mailto:cismic@xxxxxxx] Sent: Tuesday, April 13, 2004 3:13 PM To: [ISAserver.org Discussion List] Subject: [isalist] Re: ISA 2000 ARP Broadcasts? http://www.ISAserver.org Not sure but, I have some network cards that are intel cards and they send out broadcasts on 224.0.0.0 type of subent\ Maybe that's what's going on. Joseph ----- Original Message ----- From: DL.ISA To: [ISAserver.org Discussion List] Sent: Tuesday, April 13, 2004 1:03 PM Subject: [isalist] ISA 2000 ARP Broadcasts? http://www.ISAserver.org Does anyone have an insight as to why an ISA 2000 server would be conducting ARP "Who has" broadcasts for all IP addresses within it's own subnet? Thanks in advance! Mitchell D. Lawrence ------------------------------------------------------ List Archives: http://wwwwebelists.com/cgi/lyris.pl?enter=isalist ISA Server Newsletter: http://www.isaserver.org/pages/newsletter.asp ISA Server FAQ: http://www.isaserver.org/pages/larticle.asp?type=FAQ ------------------------------------------------------ Other Internet Software Marketing Sites: Leading Network Software Directory: http://www.serverfiles.com No.1 Exchange Server Resource Site: http://www.msexchange.org Windows Security Resource Site: http://www.windowsecurity.com/ Network Security Library: http://www.secinf.net/ Windows 2000/NT Fax Solutions: http://www.ntfaxfaq.com ------------------------------------------------------ You are currently subscribed to this ISAserver.org Discussion List as: cismic@xxxxxxx To unsubscribe send a blank email to $subst('Email.Unsub') ------------------------------------------------------ List Archives: http://www.webelists.com/cgi/lyris.pl?enter=isalist ISA Server Newsletter: http://www.isaserver.org/pages/newsletter.asp ISA Server FAQ: http://www.isaserver.org/pages/larticle.asp?type=FAQ ------------------------------------------------------ Other Internet Software Marketing Sites: Leading Network Software Directory: http://www.serverfiles.com No.1 Exchange Server Resource Site: http://www.msexchange.org Windows Security Resource Site: http://www.windowsecurity.com/ Network Security Library: http://www.secinf.net/ Windows 2000/NT Fax Solutions: http://www.ntfaxfaq.com ------------------------------------------------------ You are currently subscribed to this ISAserver.org Discussion List as: tradtke@xxxxxxxxxxxx To unsubscribe send a blank email to $subst('Email.Unsub') ------------------------------------------------------ List Archives: http://www.webelists.com/cgi/lyris.pl?enter=isalist ISA Server Newsletter: http://www.isaserver.org/pages/newsletter.asp ISA Server FAQ: http://www.isaserver.org/pages/larticle.asp?type=FAQ ------------------------------------------------------ Other Internet Software Marketing Sites: Leading Network Software Directory: http://www.serverfiles.com No.1 Exchange Server Resource Site: http://www.msexchange.org Windows Security Resource Site: http://www.windowsecurity.com/ Network Security Library: http://www.secinf.net/ Windows 2000/NT Fax Solutions: http://www.ntfaxfaq.com ------------------------------------------------------ You are currently subscribed to this ISAserver.org Discussion List as: cismic@xxxxxxx To unsubscribe send a blank email to $subst('Email.Unsub') ------------------------------------------------------ List Archives: http://www.webelists.com/cgi/lyris.pl?enter=isalist ISA Server Newsletter: http://www.isaserver.org/pages/newsletter.asp ISA Server FAQ: http://www.isaserver.org/pages/larticle.asp?type=FAQ ------------------------------------------------------ Other Internet Software Marketing Sites: Leading Network Software Directory: http://www.serverfiles.com No.1 Exchange Server Resource Site: http://www.msexchange.org Windows Security Resource Site: http://www.windowsecurity.com/ Network Security Library: http://www.secinf.net/ Windows 2000/NT Fax Solutions: http://www.ntfaxfaq.com ------------------------------------------------------ You are currently subscribed to this ISAserver.org Discussion List as: jim@xxxxxxxxxxxx To unsubscribe send a blank email to $subst('Email.Unsub') ------------------------------------------------------ List Archives: http://www.webelists.com/cgi/lyris.pl?enter=isalist ISA Server Newsletter: http://www.isaserver.org/pages/newsletter.asp ISA Server FAQ: http://www.isaserver.org/pages/larticle.asp?type=FAQ ------------------------------------------------------ Other Internet Software Marketing Sites: Leading Network Software Directory: http://www.serverfiles.com No.1 Exchange Server Resource Site: http://www.msexchange.org Windows Security Resource Site: http://www.windowsecurity.com/ Network Security Library: http://www.secinf.net/ Windows 2000/NT Fax Solutions: http://www.ntfaxfaq.com ------------------------------------------------------ You are currently subscribed to this ISAserver.org Discussion List as: tshinder@xxxxxxxxxxxxxxxxxx To unsubscribe send a blank email to $subst('Email.Unsub') ------------------------------------------------------ List Archives: http://www.webelists.com/cgi/lyris.pl?enter=isalist ISA Server Newsletter: http://www.isaserver.org/pages/newsletter.asp ISA Server FAQ: http://www.isaserver.org/pages/larticle.asp?type=FAQ ------------------------------------------------------ Other Internet Software Marketing Sites: Leading Network Software Directory: http://www.serverfiles.com No.1 Exchange Server Resource Site: http://www.msexchange.org Windows Security Resource Site: http://www.windowsecurity.com/ Network Security Library: http://www.secinf.net/ Windows 2000/NT Fax Solutions: http://www.ntfaxfaq.com ------------------------------------------------------ You are currently subscribed to this ISAserver.org Discussion List as: tradtke@xxxxxxxxxxxx To unsubscribe send a blank email to $subst('Email.Unsub') ------------------------------------------------------ List Archives: http://www.webelists.com/cgi/lyris.pl?enter=isalist ISA Server Newsletter: http://www.isaserver.org/pages/newsletter.asp ISA Server FAQ: http://www.isaserver.org/pages/larticle.asp?type=FAQ ------------------------------------------------------ Other Internet Software Marketing Sites: Leading Network Software Directory: http://www.serverfiles.com No.1 Exchange Server Resource Site: http://www.msexchange.org Windows Security Resource Site: http://www.windowsecurity.com/ Network Security Library: http://www.secinf.net/ Windows 2000/NT Fax Solutions: http://www.ntfaxfaq.com ------------------------------------------------------ You are currently subscribed to this ISAserver.org Discussion List as: ISA.Discussion@xxxxxxxxxxxxxxxxxxx To unsubscribe send a blank email to $subst('Email.Unsub') ------------------------------------------------------ List Archives: http://www.webelists.com/cgi/lyris.pl?enter=isalist ISA Server Newsletter: http://www.isaserver.org/pages/newsletter.asp ISA Server FAQ: http://www.isaserver.org/pages/larticle.asp?type=FAQ ------------------------------------------------------ Other Internet Software Marketing Sites: Leading Network Software Directory: http://www.serverfiles.com No.1 Exchange Server Resource Site: http://www.msexchange.org Windows Security Resource Site: http://www.windowsecurity.com/ Network Security Library: http://www.secinf.net/ Windows 2000/NT Fax Solutions: http://www.ntfaxfaq.com ------------------------------------------------------ You are currently subscribed to this ISAserver.org Discussion List as: jim@xxxxxxxxxxxx To unsubscribe send a blank email to $subst('Email.Unsub') ------------------------------------------------------ List Archives: http://www.webelists.com/cgi/lyris.pl?enter=isalist ISA Server Newsletter: http://www.isaserver.org/pages/newsletter.asp ISA Server FAQ: http://www.isaserver.org/pages/larticle.asp?type=FAQ ------------------------------------------------------ Other Internet Software Marketing Sites: Leading Network Software Directory: http://www.serverfiles.com No.1 Exchange Server Resource Site: http://www.msexchange.org Windows Security Resource Site: http://www.windowsecurity.com/ Network Security Library: http://www.secinf.net/ Windows 2000/NT Fax Solutions: http://www.ntfaxfaq.com ------------------------------------------------------ You are currently subscribed to this ISAserver.org Discussion List as: tshinder@xxxxxxxxxxxxxxxxxx To unsubscribe send a blank email to $subst('Email.Unsub') ------------------------------------------------------ List Archives: http://www.webelists.com/cgi/lyris.pl?enter=isalist ISA Server Newsletter: http://www.isaserver.org/pages/newsletter.asp ISA Server FAQ: http://www.isaserver.org/pages/larticle.asp?type=FAQ ------------------------------------------------------ Other Internet Software Marketing Sites: Leading Network Software Directory: http://www.serverfiles.com No.1 Exchange Server Resource Site: http://www.msexchange.org Windows Security Resource Site: http://www.windowsecurity.com/ Network Security Library: http://www.secinf.net/ Windows 2000/NT Fax Solutions: http://www.ntfaxfaq.com ------------------------------------------------------ You are currently subscribed to this ISAserver.org Discussion List as: jim@xxxxxxxxxxxx To unsubscribe send a blank email to $subst('Email.Unsub') ------------------------------------------------------ List Archives: http://www.webelists.com/cgi/lyris.pl?enter=isalist ISA Server Newsletter: http://www.isaserver.org/pages/newsletter.asp ISA Server FAQ: http://www.isaserver.org/pages/larticle.asp?type=FAQ ------------------------------------------------------ Other Internet Software Marketing Sites: Leading Network Software Directory: http://www.serverfiles.com No.1 Exchange Server Resource Site: http://www.msexchange.org Windows Security Resource Site: http://www.windowsecurity.com/ Network Security Library: http://www.secinf.net/ Windows 2000/NT Fax Solutions: http://www.ntfaxfaq.com ------------------------------------------------------ You are currently subscribed to this ISAserver.org Discussion List as: tshinder@xxxxxxxxxxxxxxxxxx To unsubscribe send a blank email to $subst('Email.Unsub')