"arp: moved" messages with bogus MAC addresses

[Matthew Seaman]

On 10/31/16 08:43, Christian Ullrich wrote:
> I see a lot of messages like these in the logs of my 11-STABLE VMs
> (running on VMware ESXi 6):
> 
> arp: 192.168.92.20 moved from 20:90:f1:53:01:f8 to 00:90:fb:1b:7d:cd on em0
> arp: 192.168.92.20 moved from 20:90:f1:53:01:f8 to 00:90:fb:1b:7d:cd on em0
> arp: 192.168.92.20 moved from 20:90:f1:53:01:f8 to 00:90:fb:1b:7d:cd on em0
> arp: 192.168.92.20 moved from 20:90:f1:53:01:f8 to 00:90:fb:1b:7d:cd on em0
> 
> I have no idea what causes these. The "to" MAC is correct for this IP,
> but the "from" is completely bogus. I have tcpdump'ed the network until
> two of these logs appeared, and the 20:90:f1 address never showed up; in
> fact, the byte pattern did not appear once anywhere in the dump. This
> should exclude the possibility of some weird VMware-related thing going
> on.

I see exactly the same thing with VirtualBox -- this is something to do
with the way these virtualization systems provide network access within
the host system.

Normally this message would indicate that two machines on your network
had been setup with the same IP number,  so it's generally a good thing
to have logged.  In this case however, the IP switching around between
MAC addresses seems to be normal for the virtualization environment.

You should be able to suppress the mesages by:

  # sysctl net.link.ether.inet.log_arp_movements=0

-- add "net.link.ether.inet.log_arp_movements=0" to /etc/sysctl.conf to
have that set automatically on boot.

	Cheers,

	Matthew



-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 801 bytes
Desc: OpenPGP digital signature
URL: <http://lists.freebsd.org/pipermail/freebsd-questions/attachments/20161031/d6b324b7/attachment.sig>