[j-nsp] arp arp

[Chris Morrow]

> Thursday, March 31, 2005, 11:49:16 PM, you wrote:
>
>
> RB> a junos box on my net is generating arps for unknown addresses
> RB>  to an annoying extent.  of course, we suspect scanning.  but,
> RB>  can someone suggest a simple way of discovering the cause of
> RB>  the arps?

tcpdump on a host on the subnet, look for lots of:
14:59:46.639555 arp who-has 192.0.24.5 tell 192.0.24.1

then you could atleast see who was being scanned, likely it's the whole 
netblock though :(