News: This forum is now permanently frozen.
Pages: [1]
Topic: /kernel: arp: 1.1.1.1 moved from 01:02:03:04:05 to 01:02:03:AB:CD on sis0  (Read 2159 times)
« on: May 16, 2008, 07:04:04 »
knightmb ****
Posts: 341

This isn't really a question, but I didn't find this in a search so to save someone else the in the future wondering what this error means.

This is the error I would get in the system log
Quote
/kernel: arp: 192.168.0.201 moved from 00:13:10:78:ed:f3 to 00:13:10:13:05:f0 on sis0

I saw this a lot in the logs and wondered if it was an arp poison attack or something worse. Nope, turns out it's kind of a rare event of identical devices.

Here's how it happens. I have a complex network setup with m0n0wall. One of the network segments is made up of a (3) 2-Line Vonage Routers (Linksys Brand). They are all set to DHCP and I have static IP's assigned for them in m0n0wall. They are then routed out on their own pipe via traffic shaping to make sure all my calls never get interrupted by link saturation.

But, here's what make things go bad (though I don't blame m0n0wall).  Sometimes, I power down these devices by a simple power adapter switch (all 3 are plugged into it) to clean them (dust and all).  When I flip that switch to power them all back on, because they are all identical devices, they have a very strange DHCP collision.

DHCP is designed with the thought that you will never have two devices request an IP address at the exact same time (like down to the milliseconds I mean). There will always be enough "gap" so that devices can ask for an IP and the DHCP server hand it out without too much confusion of "who" is suppose to get "which" IP address.

The problem with these devices is that they are all identical and all take the exact same time to boot and ask the DHCP server for an address.  So what happens is, one device or the other will end up getting the same IP address that another device was suppose to get. So what happens is the classic (two devices with the same IP address) problem.  That's why those errors come up in m0n0wall, it has two different MAC address both claiming to be the IP it just sent out as an assignment. The logs show how the IP address flip flops between the MAC address.

To remedy this, I have to unplug each voip router and plug them in, one at a time so that they don't all boot at exactly the same time. Everything works fine then, no IP mix up on the devices.

Hopefully, this will save someone any concern if they happen to have something similar happen on their network with m0n0wall.  Smiley

Radius Service for m0n0wall Captive Portal - http://amaranthinetech.com
« Reply #1 on: August 12, 2008, 18:32:36 »
pk *
Posts: 6

I get this a lot, more lately, on my small ISP.  More than one system using the same IP.  It's very annoying and hard to fix.  Usually involves assigning a static IP to one of the systems.  Release/renew and restart DHCP does nothing to solve the issue.
 
Pages: [1]
 
 
Powered by SMF 1.1.20 | SMF © 2013, Simple Machines