[f-nsp] IP/ARP: IP address x.y.z.t MAC movement detected, changed from (...)

[Clement Cavadore]

Hi Mike,

Sure, but in an IXP context (especially AMS-IX :)), that would also
remove the warning limit for the No. of prefix received from BGP
peers... So I think I'd prefer having those, but still seeing the
warning messages :)

Btw, I hope that it's a known bug !

Regards,

-- 
Clément

On Mon, 2014-10-13 at 10:12 -0700, Mike Tindle wrote:
> If you cannot resolve the underlying cause and these are filling up
> your logs, you can use:
> 
> 
>         no logging buffered warnings
> 
> 
> However, keep in mind that does knock out some other messages that you
> may not want to sacrifice logging.  In one of our instances, the
> tradeoff was worth it to implement the command. 
> 
> 
> Regards,
> Mike
> 
> 
> 
> On Oct 13, 2014, at 4:34 AM, Clement Cavadore <clement at cavadore.net>
> wrote:
> 
> > Hi,
> > 
> > After upgrading to 5.6 (CER devices), we keep having the following
> > messages:
> > 
> > Oct 13 12:46:03:W:IP/ARP: IP address 194.68.129.xxx MAC movement
> > detected, changed from MAC 0022.83d4.1ff0 / port 1/3 to MAC
> > 0022.8354.1ff0 / port 1/3
> > Oct 13 12:46:02:W:IP/ARP: IP address 194.68.129.xxx MAC movement
> > detected, changed from MAC 0022.8354.1ff0 / port 1/3 to MAC
> > 0022.83d4.1ff0 / port 1/3
> > Oct 13 12:44:13:W:IP/ARP: IP address 194.68.129.xxx MAC movement
> > detected, changed from MAC 0022.83d4.1ff0 / port 1/3 to MAC
> > 0022.8354.1ff0 / port 1/3
> > Oct 13 12:44:09:W:IP/ARP: IP address 194.68.129.xxx MAC movement
> > detected, changed from MAC 0022.8354.1ff0 / port 1/3 to MAC
> > 0022.83d4.1ff0 / port 1/3
> > Oct 13 12:40:14:W:IP/ARP: IP address 194.68.129.yyy MAC movement
> > detected, changed from MAC 009b.0de4.41c0 / port 1/3 to MAC
> > 001b.0de4.41c0 / port 1/3
> > Oct 13 12:40:14:W:IP/ARP: IP address 194.68.129.yyy MAC movement
> > detected, changed from MAC 001b.0de4.41c0 / port 1/3 to MAC
> > 009b.0de4.41c0 / port 1/3
> > Oct 13 12:37:40:W:IP/ARP: IP address 194.68.129.yyy MAC movement
> > detected, changed from MAC 009b.0de4.41c0 / port 1/3 to MAC
> > 001b.0de4.41c0 / port 1/3
> > Oct 13 12:37:40:W:IP/ARP: IP address 194.68.129.yyy MAC movement
> > detected, changed from MAC 001b.0de4.41c0 / port 1/3 to MAC
> > 009b.0de4.41c0 / port 1/3
> > Oct 13 12:16:50:W:IP/ARP: IP address 194.68.129.yyy MAC movement
> > detected, changed from MAC 009b.0de4.41c0 / port 1/3 to MAC
> > 001b.0de4.41c0 / port 1/3
> > Oct 13 12:16:50:W:IP/ARP: IP address 194.68.129.yyy MAC movement
> > detected, changed from MAC 001b.0de4.41c0 / port 1/3 to MAC
> > 009b.0de4.41c0 / port 1/3
> > Oct 13 12:12:02:W:IP/ARP: IP address 194.68.129.yyy MAC movement
> > detected, changed from MAC 009b.0de4.41c0 / port 1/3 to MAC
> > 001b.0de4.41c0 / port 1/3
> > Oct 13 12:12:02:W:IP/ARP: IP address 194.68.129.yyy MAC movement
> > detected, changed from MAC 001b.0de4.41c0 / port 1/3 to MAC
> > 009b.0de4.41c0 / port 1/3
> > Oct 13 12:11:44:W:IP/ARP: IP address 194.68.129.yyy MAC movement
> > detected, changed from MAC 009b.0de4.41c0 / port 1/3 to MAC
> > 001b.0de4.41c0 / port 1/3
> > Oct 13 12:11:44:W:IP/ARP: IP address 194.68.129.yyy MAC movement
> > detected, changed from MAC 001b.0de4.41c0 / port 1/3 to MAC
> > 009b.0de4.41c0 / port 1/3
> > Oct 13 12:10:16:W:IP/ARP: IP address 80.249.208.zzz MAC movement
> > detected, changed from MAC 0025.900a.0c17 / port 1/38 to MAC
> > 000e.d6b5.7c00 / port 1/38
> > Oct 13 12:09:33:W:IP/ARP: IP address 80.249.208.zzz MAC movement
> > detected, changed from MAC 000e.d6b5.7c00 / port 1/38 to MAC
> > 0025.900a.0c17 / port 1/38
> > Oct 13 12:06:18:W:IP/ARP: IP address 194.68.129.yyy MAC movement
> > detected, changed from MAC 009b.0de4.41c0 / port 1/3 to MAC
> > 001b.0de4.41c0 / port 1/3
> > Oct 13 12:06:18:W:IP/ARP: IP address 194.68.129.yyy MAC movement
> > detected, changed from MAC 001b.0de4.41c0 / port 1/3 to MAC
> > 009b.0de4.41c0 / port 1/3
> > 
> > I am pretty sure that the MACs are not really changing, as it is on
> > IXPs
> > where strict mac filtering is enabled. This happens on various
> > devices,
> > from various networks I manage. There is no operational problem,
> > apart
> > from fulfilling my log buffer
> > 
> > Anyone aware of any kind of bug with that ?
> > 
> > Thanks,
> > 
> > -- 
> > Clément Cavadore
> > 
> > 
> > _______________________________________________
> > foundry-nsp mailing list
> > foundry-nsp at puck.nether.net
> > http://puck.nether.net/mailman/listinfo/foundry-nsp
> 
> *----------- H U R R I C A N E - E L E C T R I C ---------->>
> | Mike Tindle | Senior Network Engineer | mtindle at he.net
> | ASN 6939 | http://www.he.net | 510-580-4126
> *--------------------------------------------------->>
>