[f-nsp] IP/ARP: IP address x.y.z.t MAC movement detected, changed from (...)

[Eldon Koyle]

It is quite odd that those two MAC addresses differ by one bit.  Could
this be caused by a bad chip somewhere?

I do see both MAC addresses on my network for all of the messages I have
checked so far.

-- 
Eldon Koyle
-- 
America is the country where you buy a lifetime supply of aspirin for one
dollar, and use it up in two weeks.

On  Oct 13 18:26+0200, Clement Cavadore wrote:
> I don't think so, since it is on some IXP peering LANs, and those IXP
> apply strict filtering policies on their customer ports :-)
> 
> Btw, I have noticed some strange stuffs, for example:
> 
> 
> SYSLOG: <156>Oct 13 18:22:05 rt2-th2 IP/ARP: IP address 194.68.129.xxx MAC movement detected, changed from MAC 001b.0de4.41c0 / port 1/3 to MAC 009b.0de4.41c0 / port 1/3
> SYSLOG: <156>Oct 13 18:22:05 rt2-th2 IP/ARP: IP address 194.68.129.xxx MAC movement detected, changed from MAC 009b.0de4.41c0 / port 1/3 to MAC 001b.0de4.41c0 / port 1/3
> 
> 001b.0de4.41c0 is the hw address resovled with ARP of two IP on two different IXP:
> 
> telnet at xxxx#sh arp | i 001b.0de4.41c0
> 689   80.249.208.yyy      001b.0de4.41c0      Dynamic     0        1/38      
> 904   194.68.129.xxx      001b.0de4.41c0      Dynamic     0        1/3     
> 
> 009b.0de4.41c0 does not appear anywhere on my MAC address table or ARP
> table.
> 
> On Mon, 2014-10-13 at 10:20 -0600, Eldon Koyle wrote:
> > I have been getting those messages, but I had just assumed they were
> > correct.  Is it possible that the remote device is running VRRP/HSRP?
> > 
> > Maybe it is time for me to start packet sniffing on this one.
> > 
> > -- 
> > Eldon Koyle
> 
> 
>