Why this ARP behavior?

I have two R-Shakes and one R-Boom oneline now, and all three seem to work OK. However when I was looking at my network with wireshark I see that one of them does not behave like the others. This device which is a Raspberry Shake 1D running on a RPi 3B, station name RF7DC SHZ AM 00 which has IP address 192.168.1.154 (aka rs.local) on my LAN. It sends out a broadcast ARP packet about one per second, every minute of every day, like this:
|335|58.376846|Raspberr_7a:f7:dc|Broadcast|ARP|60|Who has 192.168.1.126? Tell 192.168.1.154|
|340|59.374849|Raspberr_7a:f7:dc|Broadcast|ARP|60|Who has 192.168.1.126? Tell 192.168.1.154|
|344|60.374834|Raspberr_7a:f7:dc|Broadcast|ARP|60|Who has 192.168.1.126? Tell 192.168.1.154|

It is always looking for 192.168.1.126 but never gets a reply, as no such machine exists on my LAN. (Most of my devices use DHCP and it is possible that some time ago before a router reboot, there might have been a machine at that address, but not in the recent past.) I rebooted that Shake today but this ARP behavior continues just as before. Any idea why this is going on? My other R-Shake and R-Boom (aka rs-2.local and rs-3.local) do not do anything like this. They are all running System Version 0.15 which is the latest. Log files from the “chatty / noisy” machine RF7DC are attached below.
RSH.RF7DC.2019-09-28T16_27_36.logs.tar.zip (275.7 KB)

To clarify, there is nothing obviously wrong with this station, it is logging and reporting seismic data as normal. Without looking with wireshark I would suspect nothing. However now that I noticed this strange behavior I am curious because I don’t like unusual and unexplained network behavior.

hi john,

looking at your log files, in the ODF log file .info, i see the following startup messages:

2019 271 16:11:33>>	odf_SL_plugin: Program Starting...
2019 271 16:11:33>>	UDP Config: Registering host:port (172.17.0.1:8888)
2019 271 16:11:33>>	UDP Config: Registering host:port (192.168.1.154:8888)
2019 271 16:11:33>>	UDP Config: Registering host:port (192.168.1.126:8888)
2019 271 16:11:33>>	UDP Config: Registering host:port (192.168.1.112:8888)

where you can clearly see that you have specified IP 192.168.1.126 as a machine to send the UDP data packets to. i am going to assume that the network activity you are seeing relates to this.

please review your UDP configuration in the front-end interface and confirm the IP addresses of the computers you would like your UDP packets to be sent to, removing this entry since that machine is no longer resident.

and then verify these network packets no longer exist.

cheers,

richard

Thank you very much! You are quite correct, that was an experiment with the UDP feature I did a long time ago and then completely forgot about. Now I realize that I did have another machine last year at that address, long since removed. Sure enough that IP had been set up in the http://rs.local/config UDP STREAMS page. It all makes sense now.

regards,
John

2 Likes