[f-nsp] IP/ARP: IP address x.y.z.t MAC movement detected, changed from (...)

[Clement Cavadore]

I don't think so, since it is on some IXP peering LANs, and those IXP
apply strict filtering policies on their customer ports :-)

Btw, I have noticed some strange stuffs, for example:


SYSLOG: <156>Oct 13 18:22:05 rt2-th2 IP/ARP: IP address 194.68.129.xxx MAC movement detected, changed from MAC 001b.0de4.41c0 / port 1/3 to MAC 009b.0de4.41c0 / port 1/3
SYSLOG: <156>Oct 13 18:22:05 rt2-th2 IP/ARP: IP address 194.68.129.xxx MAC movement detected, changed from MAC 009b.0de4.41c0 / port 1/3 to MAC 001b.0de4.41c0 / port 1/3

001b.0de4.41c0 is the hw address resovled with ARP of two IP on two different IXP:

telnet at xxxx#sh arp | i 001b.0de4.41c0
689   80.249.208.yyy      001b.0de4.41c0      Dynamic     0        1/38      
904   194.68.129.xxx      001b.0de4.41c0      Dynamic     0        1/3     

009b.0de4.41c0 does not appear anywhere on my MAC address table or ARP
table.

On Mon, 2014-10-13 at 10:20 -0600, Eldon Koyle wrote:
> I have been getting those messages, but I had just assumed they were
> correct.  Is it possible that the remote device is running VRRP/HSRP?
> 
> Maybe it is time for me to start packet sniffing on this one.
> 
> -- 
> Eldon Koyle