NETGEAR is aware of a growing number of phone and online scams. To learn how to stay safe click here.

Forum Discussion

singularity_2's avatar
May 09, 2020

cable modem uses it's public IP on LAN

My C7000 cable modem sometimes uses it's public IP and MAC address on the LAN.

 

Internet: 98.xxx.xxx.95, a0:04:60:x:xx:c9

LAN: 172.16.0.1, 255.255.255.255, a0:04:60:xx:xx:ca

 

11:54:29.355222  In a0:04:60:xx:xx:ca > ff:ff:ff:ff:ff:ff, ethertype ARP (0x0806), length 60: arp who-has 172.16.0.17 tell 172.16.0.1

11:54:30.778173  In a0:04:60:xx:xx:c9 > ff:ff:ff:ff:ff:ff, ethertype ARP (0x0806), length 60: arp who-has 172.16.0.2 tell 98.xxx.xxx.95

11:54:35.819975  In a0:04:60:xx:xx:c9 > ff:ff:ff:ff:ff:ff, ethertype ARP (0x0806), length 60: arp who-has 172.16.0.2 tell 98.xxx.xxx.95

11:54:40.796601  In a0:04:60:xx:xx:c9 > ff:ff:ff:ff:ff:ff, ethertype ARP (0x0806), length 60: arp who-has 172.16.0.2 tell 98.xxx.xxx.95

 

The first line shows it correctly using it's LAN IP (172.16.0.1) and MAC (a0:04:60:xx:xx:ca) when ARPing for a LAN device.

 

The other lines show it incorrectly using it's public IP (98.xxx.xxx.95) and MAC (a0:04:60:xx:xx:c9) when ARPing for 172.16.0.2.

 

C7000

Xfinity

Hardware 1.05

Firmware V1.01.33

3 Replies

  • FURRYe38's avatar
    FURRYe38
    Guru - Experienced User

    Thats just the logs reporting NAT operations. 

    The public IP is not being used on the LAN side of the fence. 

    • singularity_2's avatar
      singularity_2
      Aspirant

      Sorry, I should have specified the logs I posted were from an Ethernet device on my local network.  The logs were not from the Netgear.

      So I see frames with the Netgear cable modem WAN IP and MAC appearing on my LAN wires.  Maybe Xfinity messed something up.

       

      I factory reset the modem, but am still seeing the frames.  If only I could SSH into the Netgear I might be able to figure something out.  My devices are ignoring the ARPs since the requester is not on their subnet.

       

      11:50:36.593959  In a0:04:60:xx.:xx:c9 > ff:ff:ff:ff:ff:ff, ethertype ARP (0x0806), length 60: arp who-has 192.168.0.200 tell 98.xxx.xxx.95

      • FURRYe38's avatar
        FURRYe38
        Guru - Experienced User

        You can contact the ISP and NG support to see if there is any information regarding this. Again, this maybe the handling of NAT operations...