Wireshark · Wireshark-users: Re: [Wireshark-users] Tons of ARP packets...?

[Guy Harris <guy@xxxxxxxxxxxx>]

IchBin wrote:
> The only problem I have is this just started last week. I have had this 
> connection since sometime in April. Why would it just now start to rear 
> it's head?
>
> I did find out that Comcast is now updating and replacing hardware for 
> higher speeds. At least that is what one of the technical support person 
> told me. So their are big network changes happening. Naturally I do not 
> remember the specific details.

Did they make any network changes last week?

> I am concerned with the DNS calls to dyndns.org. Well at least the half 
> hearted attempt. Not sure why is it appending xxz0n3dxx to the front of 
> that URL. Same goes with
> xxz0n3dxx.dyndns.org.hsd1.pa.comcast.net. If I remember correctly the 
> suffix of hsd1.pa.comcast.net is part of a real comcast DNS.

Does Comcast give the IP address assigned to your machine a DNS address 
in the hsdl.pa.comcast.net domain?  If so, if some process is trying to 
look up xxz0n3dxx.dyndns.org, when the attempt to look it up fails, the 
resolver probably says "maybe that's a non-fully-qualified domain name" 
and tries to append the domain name suffix for the domain you're in.