arp moved from [mac address] to [mac address]

[Matthew Seaman]

On Tue, Apr 29, 2003 at 10:48:52PM -0700, netgeek at speakeasy.net wrote:
> The Internet connection is through AT&T Broadband, using DHCP. When I boot, the DHCP connection is up correctly and all works. Within five minutes a series of messages like
> 
> pi /kernel: arp: 66.41.23.107 moved from 00:02:dd:30:0a:00 to 00:02:dd:30:4a:e2 on dc0
> pi /kernel: arp: 66.41.23.107 moved from 00:02:dd:30:4a:e2 to 00:02:dd:30:0a:00 on dc0
> 
> (The IP and MAC addresses are not accurate, sorry.)
> 
> As soon as this happens I cannot access anything on the Internet (IP or domain name), but the link lights stay on and ifconfig reports no change.
> 
> Are these related, and if so what is the fix?
> 
> This isn't my computer, and I'm 40 minutes away from it, so if this question needs information it might be slow in coming.

This is probably some sort of redundant fail-over system used by AT&T
-- which is all very well unless it interferes with the working of
your system.  Since the address is flipping between the interfaces so
frequently as every five minutes that's going to be a significant
degradation of your service.

So long as the IP address in question is not configured on one of your
machines' own interfaces this shouldn't have any direct effect on you
-- the log message is just your system acknowledging that the IP
number has moved to a different MAC address.

However, if you have certain types of networking kit between your
machine and the rest of the net, it may not respond very quickly to
the arp change.  Cisco switches are a case in point: they can take an
appreciable amount of time to respond to this sort of arp change.
FreeBSD in my experience is very good at recognizing such changes
quickly and responding to them.

This is something that should be able to be sorted out by
configuration changes in the networking kit --- contact the service
provider to see if they have any advice: chances are this is a problem
that many people have run into before.  Search the web as well.

	Cheers,

	Matthew

PS. To identify the manufacturer of the kit whose IP number is being
affected you can look up the 3-byte prefix of a MAC address at

    http://standards.ieee.org/regauth/oui/index.shtml

(Nb. you have to separate the octets with '-' rather than ':', vis
00-02-dd) Doesn't help much in this case though, unless 'Bromax
Communications, Ltd.' means anything to you.

-- 
Dr Matthew J Seaman MA, D.Phil.                       26 The Paddocks
                                                      Savill Way
PGP: http://www.infracaninophile.co.uk/pgpkey         Marlow
Tel: +44 1628 476614                                  Bucks., SL7 1TH UK
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 187 bytes
Desc: not available
Url : http://lists.freebsd.org/pipermail/freebsd-questions/attachments/20030430/b58e1b67/attachment.bin