kernel: arp: 192.168.1.3 moved from 02:11:e8:00:0e:0a to 00:22:15:a1:db:e8 on epair1b

[Ismael Duarte]

Hi All,

I keep seeing this lines on my log, system is working OK, should/can I do something about it?
I'm running 9.2.1.7 release.
Thank you all

Code:

Aug 16 12:00:01 duarte kernel: arp: 192.168.1.3 moved from 02:11:e8:00:0e:0a to 00:22:15:a1:db:e8 on epair1b
Aug 16 12:10:00 duarte kernel: arp: 192.168.1.3 moved from 02:02:8c:00:0d:0a to 00:22:15:a1:db:e8 on epair0b

Some more info. 192.168.1.3 is my freenas IP

Code:

#arp -a
my.router (192.168.1.1) at 00:50:7f:93:8e:b8 on ale0 expires in 1072 seconds [ethernet]
? (192.168.1.3) at 00:22:15:a1:db:e8 on ale0 permanent [ethernet]
? (192.168.1.7) at 00:09:34:22:73:58 on ale0 expires in 1199 seconds [ethernet]
? (192.168.1.16) at ac:db:ef:11:22:33 on ale0 expires in 1115 seconds [ethernet]
? (192.168.1.50) at 00:50:7f:93:8e:b8 on ale0 expires in 1037 seconds [ethernet]
? (192.168.1.21) at 02:7a:ee:00:0f:0b on ale0 permanent [ethernet]
? (192.168.1.23) at 02:a1:f7:00:0f:0b on ale0 permanent [ethernet]

Code:

# ifconfig -a
ale0: flags=8943<UP,BROADCAST,RUNNING,PROMISC,SIMPLEX,MULTICAST> metric 0 mtu 1500
        options=c3098<VLAN_MTU,VLAN_HWTAGGING,VLAN_HWCSUM,WOL_MCAST,WOL_MAGIC,VLAN_HWTSO,LINKSTATE>
        ether 00:22:15:a1:db:e8
        inet 192.168.1.3 netmask 0xffffff00 broadcast 192.168.1.255
        nd6 options=9<PERFORMNUD,IFDISABLED>
        media: Ethernet autoselect (100baseTX <full-duplex>)
        status: active
ipfw0: flags=8801<UP,SIMPLEX,MULTICAST> metric 0 mtu 65536
        nd6 options=9<PERFORMNUD,IFDISABLED>
lo0: flags=8049<UP,LOOPBACK,RUNNING,MULTICAST> metric 0 mtu 16384
        options=600003<RXCSUM,TXCSUM,RXCSUM_IPV6,TXCSUM_IPV6>
        inet6 ::1 prefixlen 128
        inet6 fe80::1%lo0 prefixlen 64 scopeid 0xb
        inet 127.0.0.1 netmask 0xff000000
        nd6 options=21<PERFORMNUD,AUTO_LINKLOCAL>
bridge0: flags=8843<UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST> metric 0 mtu 1500
        ether 02:ea:ab:6b:dd:00
        nd6 options=1<PERFORMNUD>
        id 00:00:00:00:00:00 priority 32768 hellotime 2 fwddelay 15
        maxage 20 holdcnt 6 proto rstp maxaddr 2000 timeout 1200
        root id 00:00:00:00:00:00 priority 32768 ifcost 0 port 0
        member: epair1a flags=143<LEARNING,DISCOVER,AUTOEDGE,AUTOPTP>
                ifmaxaddr 0 port 14 priority 128 path cost 2000
        member: epair0a flags=143<LEARNING,DISCOVER,AUTOEDGE,AUTOPTP>
                ifmaxaddr 0 port 13 priority 128 path cost 2000
        member: ale0 flags=143<LEARNING,DISCOVER,AUTOEDGE,AUTOPTP>
                ifmaxaddr 0 port 5 priority 128 path cost 200000
epair0a: flags=8943<UP,BROADCAST,RUNNING,PROMISC,SIMPLEX,MULTICAST> metric 0 mtu 1500
        options=8<VLAN_MTU>
        ether 02:02:8c:00:0d:0a
        nd6 options=1<PERFORMNUD>
        media: Ethernet 10Gbase-T (10Gbase-T <full-duplex>)
        status: active
epair1a: flags=8943<UP,BROADCAST,RUNNING,PROMISC,SIMPLEX,MULTICAST> metric 0 mtu 1500
        options=8<VLAN_MTU>
        ether 02:11:e8:00:0e:0a
        nd6 options=1<PERFORMNUD>
        media: Ethernet 10Gbase-T (10Gbase-T <full-duplex>)
        status: active

 

[joeschmuck]

You should have done a search for the error message and you will find many postings about it. In short, do not worry about this message.

 

[Ericloewe]

Do you have Apple devices (plural) on your network? If so, mystery solved.

In any case, as Joeschmuck said, nothing to worry about.

 

[Ismael Duarte]

No, just one iPhone and at this moment is not connected.
I've made a search for this, found a post where someone talked about duplicated IP address. No much more.
Also on ipconfig -a it shows more than one network adapter, I've only one.
BUT ... just curious, if there's nothing to worry, better.
Thank you all

 

[joeschmuck]

The messages are from an over zealous FreeNAS program monitoring your network and you should be able to track down the IP address/MAC address to some device on your network. For me and likely you too, it's a wireless device like a cell phone that drops off the network when you leave your house and comes back on the network when you arrive home. Look to your router if you want to find out more. There is a thread discussing it and a way to suppress those messages if they bug you.

 

[Ismael Duarte]

But, the IP address it's the freenas itself, not a device.

 

[joeschmuck]

Damn, you are right. This could be related to a bug fix that was "fixed" back in FreeNAS 8.3.x, or just your router doing something. You can still ignore it however thought I'd ask a few questions... Did you statically assign your FreeNAS IP address or is it by DHCP (not that your IP address is changing)?

It just looks like the MAC addresses are swapping between your two virtual NICs. Maybe someone with more experience in this area could lend a better understanding of this issue.

Find out what those MAC addresses represent, could be plugins I guess.

 

[Ismael Duarte]

My router is prepared to start DHCP from .50, below that I’ve several IP address assigned by MAC.ADDRESS. Freenas IP is one of them.
I don’t have any virtual NIC on my Freenas.

So ... still wierd

 

[joeschmuck]

I'm not sure if it's a bug report item or not but maybe it should be. Anything that is a warning message that is routine, maybe it should be omitted.

 

[panz]

Same message here, I have a LAGG configured in the failover scheme.