What could these IP addresses with MAC: 00:00:00:00:00:00 be?

17,211

Flags 0x0 and HW address of 00:00:00:00:00:00 mean it is a failed ARP.

To test ping an unused IP address on the local network and then relist. That IP address should now also show in the output of cat /proc/net/arp. Can also use the arp command which should show (incomplete) for the HWaddress for the IP addresses in question.

Share:
17,211

Related videos on Youtube

rainkinz
Author by

rainkinz

Just another kiwi dev. #SOreadytohelp

Updated on September 18, 2022

Comments

  • rainkinz
    rainkinz over 1 year

    I have a pretty much out of the box setup of openwrt, though I followed the 'securing your router guide', so password set, ssh on different port (so security through obscurity). However, I see some odd IP address connected to the WAN interface:

    root@OpenWrt:~# cat /proc/net/arp
    IP address       HW type     Flags       HW address            Mask     Device
    192.168.1.67     0x1         0x0         00:00:00:00:00:00     *        eth0.2
    192.168.1.115    0x1         0x0         00:00:00:00:00:00     *        eth0.2
    192.168.1.4      0x1         0x0         00:00:00:00:00:00     *        eth0.2
    192.168.1.1      0x1         0x2         00:1f:90:XX:XX:XX     *        eth0.2
    ...
    

    I know 192.168.1.1 is my ISPs router which I connect my OpenWRT router to, but I'm unsure what the others are. Also they have a weird MAC address. Does anyone know what that might be? My set top box has a 192.168.1 address but it is not one of these currently one of these. Could it be that it has been assigned different IP addresses at different times and ended up in my ARP table?

    I'm using BARRIER BREAKER (14.07-rc3, r42056)