[f-nsp] IP/ARP: IP address x.y.z.t MAC movement detected, changed from (...)

[Youssef Bengelloun-Zahr]

Hello Clement, All,

Let's add this one to this list of NI oddities [?]

Best regards.



2014-10-13 13:36 GMT+02:00 Clement Cavadore <clement at cavadore.net>:

> Seems that I am not alone:
>
> http://community.brocade.com/t5/Ethernet-Switches-Routers/Getting-log-message-MAC-movement-detected-after-code-upgrade-to/td-p/66490
>
> Regards,
>
> --
> Clément Cavadore
>
> On Mon, 2014-10-13 at 13:34 +0200, Clement Cavadore wrote:
> > Hi,
> >
> > After upgrading to 5.6 (CER devices), we keep having the following
> > messages:
> >
> > Oct 13 12:46:03:W:IP/ARP: IP address 194.68.129.xxx MAC movement
> detected, changed from MAC 0022.83d4.1ff0 / port 1/3 to MAC 0022.8354.1ff0
> / port 1/3
> > Oct 13 12:46:02:W:IP/ARP: IP address 194.68.129.xxx MAC movement
> detected, changed from MAC 0022.8354.1ff0 / port 1/3 to MAC 0022.83d4.1ff0
> / port 1/3
> > Oct 13 12:44:13:W:IP/ARP: IP address 194.68.129.xxx MAC movement
> detected, changed from MAC 0022.83d4.1ff0 / port 1/3 to MAC 0022.8354.1ff0
> / port 1/3
> > Oct 13 12:44:09:W:IP/ARP: IP address 194.68.129.xxx MAC movement
> detected, changed from MAC 0022.8354.1ff0 / port 1/3 to MAC 0022.83d4.1ff0
> / port 1/3
> > Oct 13 12:40:14:W:IP/ARP: IP address 194.68.129.yyy MAC movement
> detected, changed from MAC 009b.0de4.41c0 / port 1/3 to MAC 001b.0de4.41c0
> / port 1/3
> > Oct 13 12:40:14:W:IP/ARP: IP address 194.68.129.yyy MAC movement
> detected, changed from MAC 001b.0de4.41c0 / port 1/3 to MAC 009b.0de4.41c0
> / port 1/3
> > Oct 13 12:37:40:W:IP/ARP: IP address 194.68.129.yyy MAC movement
> detected, changed from MAC 009b.0de4.41c0 / port 1/3 to MAC 001b.0de4.41c0
> / port 1/3
> > Oct 13 12:37:40:W:IP/ARP: IP address 194.68.129.yyy MAC movement
> detected, changed from MAC 001b.0de4.41c0 / port 1/3 to MAC 009b.0de4.41c0
> / port 1/3
> > Oct 13 12:16:50:W:IP/ARP: IP address 194.68.129.yyy MAC movement
> detected, changed from MAC 009b.0de4.41c0 / port 1/3 to MAC 001b.0de4.41c0
> / port 1/3
> > Oct 13 12:16:50:W:IP/ARP: IP address 194.68.129.yyy MAC movement
> detected, changed from MAC 001b.0de4.41c0 / port 1/3 to MAC 009b.0de4.41c0
> / port 1/3
> > Oct 13 12:12:02:W:IP/ARP: IP address 194.68.129.yyy MAC movement
> detected, changed from MAC 009b.0de4.41c0 / port 1/3 to MAC 001b.0de4.41c0
> / port 1/3
> > Oct 13 12:12:02:W:IP/ARP: IP address 194.68.129.yyy MAC movement
> detected, changed from MAC 001b.0de4.41c0 / port 1/3 to MAC 009b.0de4.41c0
> / port 1/3
> > Oct 13 12:11:44:W:IP/ARP: IP address 194.68.129.yyy MAC movement
> detected, changed from MAC 009b.0de4.41c0 / port 1/3 to MAC 001b.0de4.41c0
> / port 1/3
> > Oct 13 12:11:44:W:IP/ARP: IP address 194.68.129.yyy MAC movement
> detected, changed from MAC 001b.0de4.41c0 / port 1/3 to MAC 009b.0de4.41c0
> / port 1/3
> > Oct 13 12:10:16:W:IP/ARP: IP address 80.249.208.zzz MAC movement
> detected, changed from MAC 0025.900a.0c17 / port 1/38 to MAC 000e.d6b5.7c00
> / port 1/38
> > Oct 13 12:09:33:W:IP/ARP: IP address 80.249.208.zzz MAC movement
> detected, changed from MAC 000e.d6b5.7c00 / port 1/38 to MAC 0025.900a.0c17
> / port 1/38
> > Oct 13 12:06:18:W:IP/ARP: IP address 194.68.129.yyy MAC movement
> detected, changed from MAC 009b.0de4.41c0 / port 1/3 to MAC 001b.0de4.41c0
> / port 1/3
> > Oct 13 12:06:18:W:IP/ARP: IP address 194.68.129.yyy MAC movement
> detected, changed from MAC 001b.0de4.41c0 / port 1/3 to MAC 009b.0de4.41c0
> / port 1/3
> >
> > I am pretty sure that the MACs are not really changing, as it is on IXPs
> > where strict mac filtering is enabled. This happens on various devices,
> > from various networks I manage. There is no operational problem, apart
> > from fulfilling my log buffer
> >
> > Anyone aware of any kind of bug with that ?
> >
> > Thanks,
> >
>
>
> _______________________________________________
> foundry-nsp mailing list
> foundry-nsp at puck.nether.net
> http://puck.nether.net/mailman/listinfo/foundry-nsp
>



-- 
Youssef BENGELLOUN-ZAHR
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://puck.nether.net/pipermail/foundry-nsp/attachments/20141013/d4934cd9/attachment.html>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: 360.gif
Type: image/gif
Size: 453 bytes
Desc: not available
URL: <https://puck.nether.net/pipermail/foundry-nsp/attachments/20141013/d4934cd9/attachment.gif>