[f-nsp] IP/ARP: IP address x.y.z.t MAC movement detected, changed from (...)

[Eldon Koyle]

I have been getting those messages, but I had just assumed they were
correct.  Is it possible that the remote device is running VRRP/HSRP?

Maybe it is time for me to start packet sniffing on this one.

-- 
Eldon Koyle
-- 
One of the lessons of history is that nothing is often a good thing to
do and always a clever thing to say.
		-- Will Durant

On  Oct 13 13:36+0200, Clement Cavadore wrote:
> Seems that I am not alone:
> http://community.brocade.com/t5/Ethernet-Switches-Routers/Getting-log-message-MAC-movement-detected-after-code-upgrade-to/td-p/66490
> 
> Regards,
> 
> -- 
> Clément Cavadore
> 
> On Mon, 2014-10-13 at 13:34 +0200, Clement Cavadore wrote:
> > Hi,
> > 
> > After upgrading to 5.6 (CER devices), we keep having the following
> > messages:
> > 
> > Oct 13 12:46:03:W:IP/ARP: IP address 194.68.129.xxx MAC movement detected, changed from MAC 0022.83d4.1ff0 / port 1/3 to MAC 0022.8354.1ff0 / port 1/3
> > Oct 13 12:46:02:W:IP/ARP: IP address 194.68.129.xxx MAC movement detected, changed from MAC 0022.8354.1ff0 / port 1/3 to MAC 0022.83d4.1ff0 / port 1/3
> > Oct 13 12:44:13:W:IP/ARP: IP address 194.68.129.xxx MAC movement detected, changed from MAC 0022.83d4.1ff0 / port 1/3 to MAC 0022.8354.1ff0 / port 1/3
> > Oct 13 12:44:09:W:IP/ARP: IP address 194.68.129.xxx MAC movement detected, changed from MAC 0022.8354.1ff0 / port 1/3 to MAC 0022.83d4.1ff0 / port 1/3
> > Oct 13 12:40:14:W:IP/ARP: IP address 194.68.129.yyy MAC movement detected, changed from MAC 009b.0de4.41c0 / port 1/3 to MAC 001b.0de4.41c0 / port 1/3
> > Oct 13 12:40:14:W:IP/ARP: IP address 194.68.129.yyy MAC movement detected, changed from MAC 001b.0de4.41c0 / port 1/3 to MAC 009b.0de4.41c0 / port 1/3
> > Oct 13 12:37:40:W:IP/ARP: IP address 194.68.129.yyy MAC movement detected, changed from MAC 009b.0de4.41c0 / port 1/3 to MAC 001b.0de4.41c0 / port 1/3
> > Oct 13 12:37:40:W:IP/ARP: IP address 194.68.129.yyy MAC movement detected, changed from MAC 001b.0de4.41c0 / port 1/3 to MAC 009b.0de4.41c0 / port 1/3
> > Oct 13 12:16:50:W:IP/ARP: IP address 194.68.129.yyy MAC movement detected, changed from MAC 009b.0de4.41c0 / port 1/3 to MAC 001b.0de4.41c0 / port 1/3
> > Oct 13 12:16:50:W:IP/ARP: IP address 194.68.129.yyy MAC movement detected, changed from MAC 001b.0de4.41c0 / port 1/3 to MAC 009b.0de4.41c0 / port 1/3
> > Oct 13 12:12:02:W:IP/ARP: IP address 194.68.129.yyy MAC movement detected, changed from MAC 009b.0de4.41c0 / port 1/3 to MAC 001b.0de4.41c0 / port 1/3
> > Oct 13 12:12:02:W:IP/ARP: IP address 194.68.129.yyy MAC movement detected, changed from MAC 001b.0de4.41c0 / port 1/3 to MAC 009b.0de4.41c0 / port 1/3
> > Oct 13 12:11:44:W:IP/ARP: IP address 194.68.129.yyy MAC movement detected, changed from MAC 009b.0de4.41c0 / port 1/3 to MAC 001b.0de4.41c0 / port 1/3
> > Oct 13 12:11:44:W:IP/ARP: IP address 194.68.129.yyy MAC movement detected, changed from MAC 001b.0de4.41c0 / port 1/3 to MAC 009b.0de4.41c0 / port 1/3
> > Oct 13 12:10:16:W:IP/ARP: IP address 80.249.208.zzz MAC movement detected, changed from MAC 0025.900a.0c17 / port 1/38 to MAC 000e.d6b5.7c00 / port 1/38
> > Oct 13 12:09:33:W:IP/ARP: IP address 80.249.208.zzz MAC movement detected, changed from MAC 000e.d6b5.7c00 / port 1/38 to MAC 0025.900a.0c17 / port 1/38
> > Oct 13 12:06:18:W:IP/ARP: IP address 194.68.129.yyy MAC movement detected, changed from MAC 009b.0de4.41c0 / port 1/3 to MAC 001b.0de4.41c0 / port 1/3
> > Oct 13 12:06:18:W:IP/ARP: IP address 194.68.129.yyy MAC movement detected, changed from MAC 001b.0de4.41c0 / port 1/3 to MAC 009b.0de4.41c0 / port 1/3
> > 
> > I am pretty sure that the MACs are not really changing, as it is on IXPs
> > where strict mac filtering is enabled. This happens on various devices,
> > from various networks I manage. There is no operational problem, apart
> > from fulfilling my log buffer
> > 
> > Anyone aware of any kind of bug with that ?
> > 
> > Thanks,
> > 
> 
> 
> _______________________________________________
> foundry-nsp mailing list
> foundry-nsp at puck.nether.net
> http://puck.nether.net/mailman/listinfo/foundry-nsp