Annoying ARP warnings

[jfc1003]

We have a Unix server and multiple Windows Servers. We recently teamed the network cards on one of our Windows servers. Ever since then, we get constant ARP warnings on the Unix server. Very annoying and disruptive.

The warning shows the date and time, then: Warning: ARP: [IP ADDRESS]moved from [mac address1] to [mac address2]

The IP address of the Windows server and the mac addresses of the two Window network cards are listed. This is annoying and we don't care. Any way to turn this off or ignore?

We are running SCO Unixware 7.1.0

 

[PHV]

You may try something like this (as root):
arp -d IPaddress

Hope This Helps, PH.
Want to get great answers to your Tek-Tips questions? Have a look at FAQ219-2884 or FAQ181-2886

 

[jfc1003]

Thanks for the response. The command worked, but after about 5 minutes, the warnings come back.

Do you know of a resource where I can read up on the arp command and the switches that work with it? There has to be an ignore option or something...

 

[PHV]

The IP address of the Windows server and the mac addresses of the two Window network cards are listed
Are you saying that your Windows server has 2 NICs with same IP address ?

Hope This Helps, PH.
Want to get great answers to your Tek-Tips questions? Have a look at FAQ219-2884 or FAQ181-2886

 

[jfc1003]

Yes, kind of. This is called teaming. Basically it sends all traffic out one card and receives on the other, or load balances as needed. It also provides redundancy if one card fails. It is quite common and we have been doing it for quite a while. Most new servers have this capability. But this Unix server does not like it

 

[jonnyknowsbest]

When you say "Most new servers have this capability", do you mean most new WINDOWS servers? Windows may be able to account for 2 NIC's having the same IP, but it is possible that Unix does not.

 

[jfc1003]

Yes, I was referring to Windows. I m sure Unix has a problem with it, but I just need to know if there is a way to make the arp warnings stop appearing on screen. I will be working on something and suddenly the arp warning fills the screen and I have to start over.

I dont care about arp warnings and want them to go away, ignore them, something.....

 

[PHV]

You may create a cronjob launching the working arp -d command for every minute.

Hope This Helps, PH.
Want to get great answers to your Tek-Tips questions? Have a look at FAQ219-2884 or FAQ181-2886

 

[dennislv]

I posted a response in your cross post.

Heres whats up. Unix does not like what you are doing. Its a Microsoft non-compliance to standards problem.

Heres how you can fix it:

You need to make an edit to you /etc/syslog.conf file. Without seeing it, I cannot tell you what needs to be changed. If you can post it, I can help you.

 

[jfc1003]

Microsoft Windows [Version 5.2.3790]
(C) Copyright 1985-2003 Microsoft Corp.

C:\>ipconfig /all

Windows IP Configuration

Host Name . . . . . . . . . . . . : mvs_exchsrvr
Primary Dns Suffix . . . . . . . : MVHOSPITAL.LOCAL
Node Type . . . . . . . . . . . . : Unknown
IP Routing Enabled. . . . . . . . : No
WINS Proxy Enabled. . . . . . . . : No
DNS Suffix Search List. . . . . . : MVHOSPITAL.LOCAL

Ethernet adapter DellTeam:

Connection-specific DNS Suffix . :
Description . . . . . . . . . . . : BASP Virtual Adapter
Physical Address. . . . . . . . . : 00-06-5B-8E-EF-80
DHCP Enabled. . . . . . . . . . . : No
IP Address. . . . . . . . . . . . : 172.22.0.2
Subnet Mask . . . . . . . . . . . : 255.255.0.0
Default Gateway . . . . . . . . . : 172.22.0.254
DNS Servers . . . . . . . . . . . : 172.22.0.103
172.22.0.1

 

[dennislv]

You're getting these messages on the SCO box correct? I need the text from /etc/syslog.conf from the SCO box.

 

[jfc1003]

#ident "@(#)syslog.conf 1.4"
#
# Portions Copyright (C) 1992 The Santa Cruz Operation, Inc.
# All Rights Reserved.
# The information in this file is provided for the exclusive use of
# the licensees of The Santa Cruz Operation, Inc. Such users have the
# right to use, modify, and incorporate this code into other products
# for purposes authorized by the license agreement provided they include
# this notice and the associated copyright notice with any such product.
# The information in this file is provided "AS IS" without warranty.
#
#
*.info,*.debug /usr/adm/syslog
local0.notice /var/adm/syslog
kern.warn /dev/console
kern.notice /dev/console

 

[dennislv]

Comment out the line

kern.warn /dev/console

like:

#kern.warn /dev/console

Also, if that doesn't do it, play the game by commenting out other lines. I believe that one should do it for you. Do you need the logs? If you do, you can change where it says /dev/console to a real file like /var/adm/syslog instead. Whatever you decide, your answer is within that file. Also, after you make a change do a 'ps -ef | grep syslog' to find the current process number (pid), then do a 'kill -HUP <pid>'

You should be fine after that. Good luck, and let me know either way.