Date: Mon, 31 Oct 2016 09:47:31 +0000 From: Matthew Seaman <matthew@FreeBSD.org> To: freebsd-questions@freebsd.org Subject: Re: "arp: moved" messages with bogus MAC addresses Message-ID: <47fb8c94-eef3-f05f-3468-f3d194624ebb@freebsd.org> In-Reply-To: <DB6PR0602MB298118FCB6F156580014BFFAD4AE0@DB6PR0602MB2981.eurprd06.prod.outlook.com> References: <DB6PR0602MB298118FCB6F156580014BFFAD4AE0@DB6PR0602MB2981.eurprd06.prod.outlook.com>
next in thread | previous in thread | raw e-mail | index | archive | help
This is an OpenPGP/MIME signed message (RFC 4880 and 3156) --H8IsofIINRKnWHPhF2dBes1neWHBPCAl4 Content-Type: multipart/mixed; boundary="gohmXDegJS1A5JjNkODqpTlSu2kQlSMkG"; protected-headers="v1" From: Matthew Seaman <matthew@freebsd.org> To: freebsd-questions@freebsd.org Message-ID: <47fb8c94-eef3-f05f-3468-f3d194624ebb@freebsd.org> Subject: Re: "arp: moved" messages with bogus MAC addresses References: <DB6PR0602MB298118FCB6F156580014BFFAD4AE0@DB6PR0602MB2981.eurprd06.prod.outlook.com> In-Reply-To: <DB6PR0602MB298118FCB6F156580014BFFAD4AE0@DB6PR0602MB2981.eurprd06.prod.outlook.com> --gohmXDegJS1A5JjNkODqpTlSu2kQlSMkG Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable On 10/31/16 08:43, Christian Ullrich wrote: > I see a lot of messages like these in the logs of my 11-STABLE VMs > (running on VMware ESXi 6): >=20 > arp: 192.168.92.20 moved from 20:90:f1:53:01:f8 to 00:90:fb:1b:7d:cd on= em0 > arp: 192.168.92.20 moved from 20:90:f1:53:01:f8 to 00:90:fb:1b:7d:cd on= em0 > arp: 192.168.92.20 moved from 20:90:f1:53:01:f8 to 00:90:fb:1b:7d:cd on= em0 > arp: 192.168.92.20 moved from 20:90:f1:53:01:f8 to 00:90:fb:1b:7d:cd on= em0 >=20 > I have no idea what causes these. The "to" MAC is correct for this IP, > but the "from" is completely bogus. I have tcpdump'ed the network until= > two of these logs appeared, and the 20:90:f1 address never showed up; i= n > fact, the byte pattern did not appear once anywhere in the dump. This > should exclude the possibility of some weird VMware-related thing going= > on. I see exactly the same thing with VirtualBox -- this is something to do with the way these virtualization systems provide network access within the host system. Normally this message would indicate that two machines on your network had been setup with the same IP number, so it's generally a good thing to have logged. In this case however, the IP switching around between MAC addresses seems to be normal for the virtualization environment. You should be able to suppress the mesages by: # sysctl net.link.ether.inet.log_arp_movements=3D0 -- add "net.link.ether.inet.log_arp_movements=3D0" to /etc/sysctl.conf to= have that set automatically on boot. Cheers, Matthew --gohmXDegJS1A5JjNkODqpTlSu2kQlSMkG-- --H8IsofIINRKnWHPhF2dBes1neWHBPCAl4 Content-Type: application/pgp-signature; name="signature.asc" Content-Description: OpenPGP digital signature Content-Disposition: attachment; filename="signature.asc" -----BEGIN PGP SIGNATURE----- iQIcBAEBCgAGBQJYFxM6AAoJEABRPxDgqeTn/DIP/20CHXBd0OOodTTpODvB9/13 l58McBQgKd1MEbbVLzuWF4gpaYMXi/3JjYH/nq1R4Ly4sdm1Q9O15VTvo46NIUwM sXkMUaNo2O9fOnn2F6dj9v4EiV4lg9SDp3DHHDTW4LPpb1/uXfh0jbDykRH4J6pm VPKFQbDI5aa/aM03dOePyzHzBUlafMrpFWEnYaXwhurqTbYw4FJeBsFmoBrtgZ6n fo7fYJAOfPtCAoHzZEVi7FvCtGhRmXtpk1Kjq/7QYwKWHS4Tl9To0zorMORO+RxG DiRR2kWUKJWO3yawcp6WFjeFRAeVLx4ZrxVEgN93VRz7m0ItygcqiwGm4RZV38Hv zvKVUSzMCKlaK9qr33kKhTgeYOLtkez9JAlMMu1Wmc+L/F6hSsZ5tPf3YiKYhjoy Mh5t2fuW4SqQ+WmlQRVD6Axu87XCa4JX+qO827yrN/B34PB4DVUogZt6YzG5GUpc 338YALd3HTevBjNJj2WTz1/VvNFf5a70Jvc19KMdBlm3AGVNsnIEEeTd+kCnwdnd A/X9xGm+bjHs7UW3dGJlDtTVpeV0BW3R/1ckCEJmG7hLG21dkxjHB7rJgl98OvZX ZAIfP402yrlZW0b2q+lO4Ebs1IhTkTKwaMtZRwZHkUXDDa/Y+kOs3+ttLsUtYrTj qDUJmi/HD9xeVlzaLPRL =LqkD -----END PGP SIGNATURE----- --H8IsofIINRKnWHPhF2dBes1neWHBPCAl4--
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?47fb8c94-eef3-f05f-3468-f3d194624ebb>