multiple gratuitous ARPs from multipe hosts

[Birbone]

Has anyone seen anything like this before? If so what was the identified cause.

We have an UNIX machine that is continually reporting duplicate IP address against three different windows machines that are not reporting any dups. The messages started just after three hard power hits in our data center that took down all systems and switches. The windows machines are not reporting the dups, and the UNIX system shows a clean ARP. The capture form the UNIX side identifies the same three machine/MACs reported in the error log. The networking team reported it would not be a switch issue as it only passes packets straight through.


-B

 

[brianinms]

1. Go buy a huge UPS system and Generator.

2. So are you saying you see multiple mac addresses for the same ip address?

 

[Birbone]

(1) LOL. We have those, but there wasn't much that could be done when the PDU went down hard. We now have two PDUs.

(2) Yes. The syslog is reporting "Duplicate IP Address found" warning messages against three different MAC address. A startsrc -s iptrace -a "-i en3 -s host_ip_address -b /tmp/iptrace.out" shows that the same IP address is associated with all three MACs.

Interesting huh???

-B

 

[LawnBoy]

Time to break out a packet sniffer, like Wireshark (Ethereal).


"We must fall back upon the old axiom that when all other contingencies fail, whatever remains, however improbable, must be the truth." - Sherlock Holmes

 

[Birbone]

I agree with the axiom.

-B

 

[brianinms]

Does the Windows server run ISA or any remote vpn?

 

[Birbone]

No ISA or remote vpn.

-B