Hi, I’m looking for a little network help. On the morning of Thursday April 21 before turning on my computer, I noticed the activity light on my Motorola SB5100 modem and the WAN (Internet) light on my Asus router flashing constantly. Checking the Traffic Monitor on the router I could see a 3-5 KB/s of incoming traffic none of which was making it to my computer. This has been happening 24/7 since Thursday.
I called Rogers and was told the flashing was normal but my modem (which I own) was very old and it had likely failed. I have a friend on the other side of town with a similar modem, so I asked him to check his and it is doing the same thing.
This morning I removed the router and connected my computer directly to the modem. When the computer was boot the modem flashing started again. I ran Wireshark and did a quick capture which showed I was getting 40-50 ARP requests per second.
They are all similar to this, each one with different seemingly random IPs:
Source Dest Prot Size Info
Casa_91:68:1F Broadcast ARP 60 Who has 220.127.116.11? Tell 18.104.22.168
I’m wondering if it has anything to do with Roger’s implementation of IPv6. Maybe trying to assign an IPv6 IP to an IPv4 only device.
Any help would be appreciated.
Solved! Solved! Go to Solution.
My guess would be a bot possibly running on a corrupted router or modem somewhere. The source address doesn't make sense to me, "Casa_91:68:1F" given that the request is for an IPV4 address. Maybe someone with better knowledge of IP addressing can figure this out. @RogersMoin I suspect that you would need @LF1949's IP address in order for the NOC to start tracing this.
Thank Morin and Datalink,
Glad you can see that the issue is not confined the the 24.xxx.xxx.xxx IP.
When I contacted Rogers Internet Tech Support on the 21st, I knew I wasn't talking to the right department. Hopefully Moin's contact will be someone who understands the issue.
From what I've read they call this an "ARP Broadcast Flood or Storm".
Other then the extra overhead, my system is working normally.
Just a quick follow-up. I got some information from another forum that might make sense. I'm told the CMTS (Cable Modem Termination System) sends out ARP requests but most are usually filtered out. The sourse address of the requests is "Casa_91:68:1F" which made no sense until I discovered Casa Systems is a networking hardware supplier like Cisco and Arris. My guess now is that when Rogers implmented IPv6 in this area, the CMTS (mayber made by Casa) configuration was changed and they are no longer filtering the ARP requests.
Since I'm on a low usage package (60G) I still am trying to determine if this overhead is being added to my usage. I can monitor my usage at my computer and was planning on confirming it with the MyRogers numbers, but the online usage summary has not been updated since April 20th (5 days). I reported that to Rogers billing this morning who were unaware of any problem. Maybe Morin can look into this as well.
I appreciate you posting the findings, I believe your guess is correct though I'll update the thread once I get the response from the NOC department.
As for the usage not getting updated, I can have that investigated for you. I've sent a private message, please check your Inbox, thank you.