Date: Sat, 14 Jun 2003 12:43:35 -0500 From: Dan Nelson <dnelson@allantgroup.com> To: ODHIAMBO Washington <wash@wananchi.com>, FBSD-Q <freebsd-questions@freebsd.org> Subject: Re: arp messages: Why is this happening? Message-ID: <20030614174334.GT53468@dan.emsphone.com> In-Reply-To: <20030614095212.GC87960@ns2.wananchi.com> References: <20030613152226.GA91843@ns2.wananchi.com> <20030613154057.GN53468@dan.emsphone.com> <20030614095212.GC87960@ns2.wananchi.com>
next in thread | previous in thread | raw e-mail | index | archive | help
In the last episode (Jun 14), ODHIAMBO Washington said: > * Dan Nelson <dnelson@allantgroup.com> [20030613 18:40]: wrote: > > In the last episode (Jun 13), ODHIAMBO Washington said: > > > > > > My log files (and console) fill up with these messages. > > > > > > > arp: 62.8.64.172 moved from 00:c0:05:11:01:f1 to 00:c0:05:10:01:f1 on bge1 > > > > arp: 62.8.64.201 moved from 00:c0:05:10:01:f1 to 00:c0:05:11:01:f1 on bge1 > > > > arp: 62.8.64.201 moved from 00:c0:05:11:01:f1 to 00:c0:05:10:01:f1 on bge1 > > > > arp: 62.8.64.145 moved from 00:c0:05:11:01:f1 to 00:c0:05:10:01:f1 on bge1 > > > > arp: 62.8.64.212 moved from 00:c0:05:11:01:f1 to 00:c0:05:10:01:f1 on bge1 > > > > arp: 62.8.64.188 moved from 00:c0:05:11:01:f1 to 00:c0:05:10:01:f1 on bge1 > > > ... > > > > What are the machines at those two mac addresses? Are they maybe > > clustered servers, and during failover, you see an arp line for each ip > > that gets moved from one to the other > > Now that points me towards some clue ... those mac addresses are not even on > the box where I am seeing these messages..... > I can see the mac addresses by using ifconfig, yes?? > So some machines, possibly routers, are doing this... Maybe. Routers shouldn't cause this because they only deal with packets not in your subnet. The kernel only keeps MAC addresses for IPs in your subnet. Your kernel is complaining that incoming packets that were coming in with an IP of 62.8.64.188 and a MAC address of 00:c0:05:11:01:f1 are now arriving with a MAC address of 00:c0:05:10:01:f1. This could mean that two active phyical machines are configured with the same IP address (i.e. an IP conflict), two physical machines alternate using that IP (i.e. failover clustering), or that your ifconfig netmask is too large and the kernel is remembering MAC addresses for IPs that it should really be forwaring to a router instead. You can use the "arp -a" or "netstat -r" commands to display the IP-MAC mappings the kernel knows about. -- Dan Nelson dnelson@allantgroup.com
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20030614174334.GT53468>