I have a machine that runs a network intensive application that spawns many processes. I noticed recently that the machine is producing ARP requests looking for an IP address that does not exist. I would like to trace down which process on the box is causing the ARP requests to be generated for the sake of troubleshooting (so I can know which part of the application is looking for this non-existant IP).
IP's have been changed but they aren't important anyhow.
I discovered these ARP requests by running
tcpdump on another machine on the same network:
# tcpdump -i eth0 arp -t -n ARP, Request who-has 220.127.116.11 tell 18.104.22.168, length 46
There isn't meant to be a device with the address
22.214.171.124, so I want to find what process on
126.96.36.199 is looking for it.
I tried using
ss -np | grep 188.8.131.52 as well as
netstat -np | grep 184.108.40.206 (
netstat is considered deprecated in place of
ss for those curious,
ss has most of the same options and is meant to perform the same functions). Neither of these return any results, likely because
netstat list open sockets, and the ARP request would pre-date a socket being created.
So how can I discern what process causes an ARP request?