[TriLUG] Why is 1.1.1.1 on my network?

[Jeff Schornick]

On Wed, Mar 3, 2010 at 11:33, Scott Lambdin <lopaki at gmail.com> wrote:
> If it is not in your arp cache, then I guess it must be routed?  Traceroute?

Scott is right.  This becomes a basic layer 2 versus layer 3
networking question.  It is absolutely worth learning the difference
if you want to feel more confident in your networking troubleshooting
skills.

In this case, if your test host's routing table doesn't have a route
that matches 1.1.1.1, it will forward it to the routing table's
default gateway.  The only ARP entry in use at that point is that of
that gateway.

Traceroute, mtr, and hping are great tools to see where it actually
does live out there on the network.

  - Jeff