Mailing Lists: Apple Mailing Lists
Image of Mac OS face in stamp
Re: arp moved from to on
[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

Re: arp moved from to on



At 2:42 PM -0400 5/9/06, Paul Thompson wrote:
  Hi Everyone,

I'm trying to track down an entry that keeps showing up in my system logs. It appears on all of my machines, and it doesn't matter whether it's a server or client machine. This one happens to be from one of my servers. All machines are 10.4.6 In the space of 45 minutes I have had over 65 entries for this.

May 8 18:36:15 adultserver kernel[0]: arp: 10.2.0.1 moved from 00:00:5e:00:01:02 to 00:0e:62:4e:c0:02 on en0
May 8 18:36:16 adultserver kernel[0]: arp: 10.2.0.1 moved from 00:0e:62:4e:c0:02 to 00:00:5e:00:01:02 on en0


  Now the 10.2.0.1 address is from the router

According to http://standards.ieee.org/regauth/oui/index.shtml the 00-0e-62 is registered to Nortel Networks, which makes sense as that is what our main router is. The 00-00-5e is apparently registered to USC Information Sciences Inst. I ran ethereal on the network and received this back:
Source: IETF-VRRP-virtual-router-VRID_02 (00:00:5e:00:01:02) I didn't see the 00:0e:62:4e:c0:02 address.


Now, I searched the archives and, in a posting from May 23 2004 from Dan Shoop, found out that this might be happening due to the following possibilities:

(1) The machine has multiple NIs and it's switch the NI it's using.

(2) The IP address has failed over to another machine

(3) The IP address is dynamically assigned (say by DHCP) and a new system has gotten this IP.

(4) You're network is fuxored and you have more than one machine with the same address and both are advertising the same IP.

  So, I ran an arp -a from my local box, and came back with this:

? (10.2.0.1) at 0:0:5e:0:1:2 on en0 [ethernet]

  and then I ran an netstat -rn and received this back:

Routing tables

Internet:
Destination Gateway Flags Refs Use Netif Expire
default 10.2.0.1 UGSc 95 50 en0
10.2/16 link#4 UCS 117 0 en0
10.2.0.1 0:0:5e:0:1:2 UHLW 94 0 en0 1197


I have also tried looking at both of these links for ideas to try to solve this:

http://forums.macosxhints.com/archive/index.php/t-44486.html
http://forums.macosxhints.com/archive/index.php/t-6812.html

Does anyone have an idea on why it is flipping back and forth between the two MAC addresses? I would like to get this fixed so the router is not always switching between the two MAC addresses. I have mentioned this to the other network admin, but he has told me that he doesn't see it happening on his Windows machines, but as far as I can tell it seems to be coming from the main router. I've been told that I should only be seeing the 00:00:5e:00:01:02 address.

Another important question is how much is this impacting my network performance if the main router is constantly switching back and forth like this?

Who has the offending MAC addresses that this IP is flip flopping over?

You may also have a MAC that appears on two different network segments.
--

-dhan

------------------------------------------------------------------------
Dan Shoop                                                   AIM: iWiring
Systems & Networks Architect                      http://www.ustsvs.com/
email@hidden                                http://www.iwiring.net/
1-714-363-1174

pgp key fingerprint: FAC0 9434 B5A5 24A8 D0AF  12B1 7840 3BE7 3736 DE0B

iWiring provides systems and networks support for Mac OS X, unix, and
Open Source application technologies at affordable rates.
_______________________________________________
Do not post admin requests to the list. They will be ignored.
Macos-x-server mailing list      (email@hidden)
Help/Unsubscribe/Update your Subscription:
This email sent to email@hidden


References: 
 >arp moved from to on (From: Paul Thompson <email@hidden>)



Visit the Apple Store online or at retail locations.
1-800-MY-APPLE

Contact Apple | Terms of Use | Privacy Policy

Copyright © 2011 Apple Inc. All rights reserved.