Date: Mon, 31 Oct 2016 08:43:36 +0000 From: Christian Ullrich <chris@chrullrich.net> To: "freebsd-questions@freebsd.org" <freebsd-questions@freebsd.org> Subject: "arp: moved" messages with bogus MAC addresses Message-ID: <DB6PR0602MB298118FCB6F156580014BFFAD4AE0@DB6PR0602MB2981.eurprd06.prod.outlook.com>
next in thread | raw e-mail | index | archive | help
Hello, I see a lot of messages like these in the logs of my 11-STABLE VMs (running on VMware ESXi 6): arp: 192.168.92.20 moved from 20:90:f1:53:01:f8 to 00:90:fb:1b:7d:cd on em0 arp: 192.168.92.20 moved from 20:90:f1:53:01:f8 to 00:90:fb:1b:7d:cd on em0 arp: 192.168.92.20 moved from 20:90:f1:53:01:f8 to 00:90:fb:1b:7d:cd on em0 arp: 192.168.92.20 moved from 20:90:f1:53:01:f8 to 00:90:fb:1b:7d:cd on em0 I have no idea what causes these. The "to" MAC is correct for this IP, but the "from" is completely bogus. I have tcpdump'ed the network until two of these logs appeared, and the 20:90:f1 address never showed up; in fact, the byte pattern did not appear once anywhere in the dump. This should exclude the possibility of some weird VMware-related thing going on. This is not the only IP that shows this strange behavior: Oct 29 15:00:04 infra11build kernel: arp: 192.168.92.1 moved from 20:76:c6:03:00:f8 to 00:90:fb:1d:b0:48 on em0 Oct 29 15:00:04 infra1 kernel: arp: 192.168.92.1 moved from 20:52:96:05:00:f8 to 00:90:fb:1d:b0:48 on em0 Oct 29 15:00:04 infra2 kernel: arp: 192.168.92.1 moved from 20:1e:92:04:00:f8 to 00:90:fb:1d:b0:48 on em0 Note that these entries are from the same second, and show three different but similar "from" addresses. Since they all happened in that one second, I suppose there must have been some event common to all three systems. There are no logs anywhere about the MAC addresses changing in the other direction. All three are running the same world and kernel, so if this is actually a kernel bug, it makes sense that it shows up on all three. I have looked through the commit logs and searched for bug reports that refer to this, but could not find anything. # uname -a FreeBSD infra11build 11.0-STABLE FreeBSD 11.0-STABLE #0 54dcedb(stable/11): Fri Oct 14 17:29:16 CEST 2016 toor@infra11build:/usr/obj/usr/src/sys/GENERIC amd64 Has anyone seen this before? Thanks for any hints, sorry if this message shows up twice (please disregard the other one), -- Christian
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?DB6PR0602MB298118FCB6F156580014BFFAD4AE0>