Sharp copy machine answering ARP requests for Gateway

[Huminator]

Anyone ever heard of anything like this. Gateway is 10.25.1.1 and the sharp copy machine was answering arp requests for it. It caused mucho connectivity issues for an entire building at work! Nobody knows why here. The printer's IP was not set to the gateway ip.

TIA

 

[Elixer]

What model # is this copy machine, and how did you determine your findings?

 

[Huminator]

It is a Sharp AR-M207. We saw it answering gateway traffic in Wireshark. The IP was set to 10.25.225.9 and the gateway is 10.25.1.1. Everyone here is at a loss as to how it's answering ARP requests for the gateway. We're a mostly Cisco shop. At least for R&S.

https://drive.google.com/file/d/0B3-d8crjDb1Ld29SbWFfUEM1SFU/view?usp=sharing

 

[Gryz]

Machines sending out ARP replies that look like they are random often happen when:

1) the machine is configured with the wrong subnetmask. or other machines on the network are configured with wrong subnetmasks.
2) the offending machine has "proxy ARP" enabled.

Not sure it is the case here. But it is the first thing I would look at. Subnet masks.

 

[JackMDS]

It caused mucho connectivity issues for an entire building at work! Nobody knows why here.

TIA

Wow, what a Big trouble I guess that chupacabra sits on the Power plug/network connection of the printer and does not let you to disconnect it until you find a solution.

======================
http://www.kb.lesolson.com/InstantKB20/KnowledgebaseArticle50454.aspx

www.[B]sharp[/B].se/cps/rde/xbcr/.../arm207_om_setupguide_gb.pdf

 

[Huminator]

Wow, what a Big trouble I guess that chupacabra sits on the Power plug/network connection of the printer and does not let you to disconnect it until you find a solution.

======================
http://www.kb.lesolson.com/InstantKB20/KnowledgebaseArticle50454.aspx

www.[B]sharp[/B].se/cps/rde/xbcr/.../arm207_om_setupguide_gb.pdf

It took a while to track it down because there were other issues that kind of masked this issue i.e a security video feed that was hogging a big portion of the wan link. Plus the site has a small pipe (10Meg) which was constantly near max. Once we tracked it down we immediately shut down its port, but I was wondering if anyone had seen anything like this before since Google basically returned nothing.

 

[Huminator]

Machines sending out ARP replies that look like they are random often happen when:

1) the machine is configured with the wrong subnetmask. or other machines on the network are configured with wrong subnetmasks.
2) the offending machine has "proxy ARP" enabled.

Not sure it is the case here. But it is the first thing I would look at. Subnet masks.

You are correct. It was configged with a /24 subnet mask and it should have been a /21!

 

[Gryz]

You are correct. It was configged with a /24 subnet mask and it should have been a /21!

Thanks for coming back and acknowledging the correct answer.

Often people ask questions on fora. People give suggestions how to troubleshoot or how to fix such issues. And then we never hear back. Writing answers on fora, for people who later might have the same problem, can be very helpful for the future.

 

[kevnich2]

You are correct. It was configged with a /24 subnet mask and it should have been a /21!

Your sharp copier was set with an IP of 10.25.225.9 with a /24 subnet mask and a gateway address of 10.25.1.1? Since that gateway isn't in that subnet at all, it shouldn't have even allowed that to begin with?

 

[Huminator]

Sorry I was wrong. The subnet was supposed to be /16 not a /21. I don't think that would make a difference though.