From owner-freebsd-questions@FreeBSD.ORG Sat Jun 14 10:43:41 2003 Return-Path: Delivered-To: freebsd-questions@freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id BEC9637B404 for ; Sat, 14 Jun 2003 10:43:41 -0700 (PDT) Received: from dan.emsphone.com (dan.emsphone.com [199.67.51.101]) by mx1.FreeBSD.org (Postfix) with ESMTP id 4B15E43FBD for ; Sat, 14 Jun 2003 10:43:40 -0700 (PDT) (envelope-from dan@dan.emsphone.com) Received: (from dan@localhost) by dan.emsphone.com (8.12.9/8.12.9) id h5EHhZff035282; Sat, 14 Jun 2003 12:43:35 -0500 (CDT) (envelope-from dan) Date: Sat, 14 Jun 2003 12:43:35 -0500 From: Dan Nelson To: ODHIAMBO Washington , FBSD-Q Message-ID: <20030614174334.GT53468@dan.emsphone.com> References: <20030613152226.GA91843@ns2.wananchi.com> <20030613154057.GN53468@dan.emsphone.com> <20030614095212.GC87960@ns2.wananchi.com> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <20030614095212.GC87960@ns2.wananchi.com> X-OS: FreeBSD 5.1-CURRENT X-message-flag: Outlook Error User-Agent: Mutt/1.5.4i Subject: Re: arp messages: Why is this happening? X-BeenThere: freebsd-questions@freebsd.org X-Mailman-Version: 2.1.1 Precedence: list List-Id: User questions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 14 Jun 2003 17:43:42 -0000 In the last episode (Jun 14), ODHIAMBO Washington said: > * Dan Nelson [20030613 18:40]: wrote: > > In the last episode (Jun 13), ODHIAMBO Washington said: > > > > > > My log files (and console) fill up with these messages. > > > > > > > arp: 62.8.64.172 moved from 00:c0:05:11:01:f1 to 00:c0:05:10:01:f1 on bge1 > > > > arp: 62.8.64.201 moved from 00:c0:05:10:01:f1 to 00:c0:05:11:01:f1 on bge1 > > > > arp: 62.8.64.201 moved from 00:c0:05:11:01:f1 to 00:c0:05:10:01:f1 on bge1 > > > > arp: 62.8.64.145 moved from 00:c0:05:11:01:f1 to 00:c0:05:10:01:f1 on bge1 > > > > arp: 62.8.64.212 moved from 00:c0:05:11:01:f1 to 00:c0:05:10:01:f1 on bge1 > > > > arp: 62.8.64.188 moved from 00:c0:05:11:01:f1 to 00:c0:05:10:01:f1 on bge1 > > > ... > > > > What are the machines at those two mac addresses? Are they maybe > > clustered servers, and during failover, you see an arp line for each ip > > that gets moved from one to the other > > Now that points me towards some clue ... those mac addresses are not even on > the box where I am seeing these messages..... > I can see the mac addresses by using ifconfig, yes?? > So some machines, possibly routers, are doing this... Maybe. Routers shouldn't cause this because they only deal with packets not in your subnet. The kernel only keeps MAC addresses for IPs in your subnet. Your kernel is complaining that incoming packets that were coming in with an IP of 62.8.64.188 and a MAC address of 00:c0:05:11:01:f1 are now arriving with a MAC address of 00:c0:05:10:01:f1. This could mean that two active phyical machines are configured with the same IP address (i.e. an IP conflict), two physical machines alternate using that IP (i.e. failover clustering), or that your ifconfig netmask is too large and the kernel is remembering MAC addresses for IPs that it should really be forwaring to a router instead. You can use the "arp -a" or "netstat -r" commands to display the IP-MAC mappings the kernel knows about. -- Dan Nelson dnelson@allantgroup.com