ARP table filling by 00:00:00:00:00:00

Hi,

today I spot on my router this odd thing, ARP table is filling up with non-existent IPs with 0’s MACs, odd thing is it happens only on two VLAN adapters and IPs are adding to list from backward (254,253,252…). That VLANs had a networks 192.168.66.xx and 55.x and it is filled in loop like 66.254, 66.253…66.2 then it start over at 55.254 and again it goes down to 55.2 and start again at 66.254… Have anybody idea what is it, I cannot find source of this strange thing, looks like it stop only if I change ARP from enabled to reply-only on VLAN adapter, after I change it back to enabled it start again. It looks like as slow IP scan or so but it is very odd.
Router RB750r2 v6.35.2 and nothing was changed in router config or so, this weird thing just happen from nowhere.

Any idea?
Thanks

Looks like someone is IP scanning your network.

MikroTik recently added this. Actually 00:00:00:00:00:00 is not an MAC address. It is just how empty ARP entry looks like. Support told me that in past they simply did not show these entries and started to show them so clients would be able to see this and trace issues if they have them. Basically changed from hide to show.

I see that you are using VLAN_666 , no need to look further !
you are using the beast VLAN number and have probably summoned an angry deamon (a real one, not a background process) which started messing with your ARP table.


or

you did a IP scan or tried to ping those IPs and got no reply.

for me it looks as IP scanner too but I cannot catch a source, unathorized access to network is almost impossible (but not absolute impossible), that was first what I check if some try hack over Wifi but I not found any suspicous activity nowhere (in truth I found one unknown MAC on one Wifi AP what was trying to connect but it not pass WPA2 and this MAC I not found active in network and Wifi is not on VLANs, this VLANs have dedicated usage). This just ,happen" and only on this 2 VLAN’s and nowhere else (there are 3 VLANs and some standard non-vlan networks). After about 1 hour after I post that question this activity disappear as they come (from nowhere or as was said - from hell :laughing: ). But it is still odd :open_mouth:

The beast has distorted your view … it’s 555

there are both, 555 and 666 :slight_smile: