"arp: moved" messages with bogus MAC addresses

Christian Ullrich chris at chrullrich.net
Mon Oct 31 09:16:59 UTC 2016


Hello,

I see a lot of messages like these in the logs of my 11-STABLE VMs
(running on VMware ESXi 6):

arp: 192.168.92.20 moved from 20:90:f1:53:01:f8 to 00:90:fb:1b:7d:cd on em0
arp: 192.168.92.20 moved from 20:90:f1:53:01:f8 to 00:90:fb:1b:7d:cd on em0
arp: 192.168.92.20 moved from 20:90:f1:53:01:f8 to 00:90:fb:1b:7d:cd on em0
arp: 192.168.92.20 moved from 20:90:f1:53:01:f8 to 00:90:fb:1b:7d:cd on em0

I have no idea what causes these. The "to" MAC is correct for this IP,
but the "from" is completely bogus. I have tcpdump'ed the network until
two of these logs appeared, and the 20:90:f1 address never showed up; in
fact, the byte pattern did not appear once anywhere in the dump. This
should exclude the possibility of some weird VMware-related thing going
on.

This is not the only IP that shows this strange behavior:

Oct 29 15:00:04 infra11build kernel: arp: 192.168.92.1 moved from 20:76:c6:03:00:f8 to 00:90:fb:1d:b0:48 on em0
Oct 29 15:00:04 infra1 kernel: arp: 192.168.92.1 moved from 20:52:96:05:00:f8 to 00:90:fb:1d:b0:48 on em0
Oct 29 15:00:04 infra2 kernel: arp: 192.168.92.1 moved from 20:1e:92:04:00:f8 to 00:90:fb:1d:b0:48 on em0

Note that these entries are from the same second, and show three
different but similar "from" addresses. Since they all happened in that
one second, I suppose there must have been some event common to all
three systems.

There are no logs anywhere about the MAC addresses changing in the other
direction.

All three are running the same world and kernel, so if this is actually
a kernel bug, it makes sense that it shows up on all three. I have
looked through the commit logs and searched for bug reports that refer
to this, but could not find anything.

# uname -a
FreeBSD infra11build 11.0-STABLE FreeBSD 11.0-STABLE #0 54dcedb(stable/11): Fri Oct 14 17:29:16 CEST 2016 toor at infra11build:/usr/obj/usr/src/sys/GENERIC  amd64

Has anyone seen this before?

Thanks for any hints,
sorry if this message shows up twice (please disregard the other one),

-- 
Christian



More information about the freebsd-questions mailing list