What are these 'arp xxx moved to epair yyy' kernel logs

[wintermute000]

I'm getting occasional email alerts like this
freenas.xxx.com.au kernel log messages:
> arp: (LAN IP) moved from 02:xxxx to yyyy:4f:06 on epair3b
> arp: (LAN IP) moved from 02:xxxx to yyyy:4f:06 on epair2b
> arp: (LAN IP) moved from 02:xxxx to yyyy:4f:06 on epair1b
> arp: (LAN IP) moved from 02:xxxx to yyyy:4f:06 on epair0b

Now 4f06 is my NIC's real MAC, the MACs on the left are virtual from the epairs.

I have not noticed any 'problems' with functionality at all, and they tend to come through in the middle of the night. I've had maybe two in a week.

a.) what the heck is going on
b.) should i be worried

This doesn't make a lot of sense to me as my jails have their own IPs obviously, so why would my LAN IP go from a jail virtual interface MAC (where its never been) back to the real MAC. Also I am not being sent the message that my LAN IP has 'left' my real NIC and moved across to the virtual. As a networker by day (i.e. router guy) this is really confusing and worrying. Or is my NIC driver/kernel having hiccups? Why would my jail virtual interfaces be responding to ARPs for my real IP that's configured against a real NIC with a real MAC? I do understand that maybe its bridged across but the msg is ambiguous i.e. what the heck is 'moved' mean, is the kernel somehow resolving an ARP request (I presume) and replying with teh MAC of my jail for some reason?

9.2.1.7
Asrock C2550D4I, 16Gb ECC DDR3, 6x4Tb HGST Deskstar NAS HDD in RAIDZ2, 1x256Gb Sandisk Ultra Plus SSD in ISCSI extent, 1x 256Gb Sandisk Ultra Plus SSD scratch disk, Seasonic SSR-450RM 450W, Fractal Design Define R2
igb0 with the problem LAN IP above
igb1 on second nic with different IP/MAC, not referenced in this error
both NICs are intel
a few jails



Thanks in advance

 

[Knowltey]

http://forums.freenas.org/index.php?threads/forum-rules.22553/#post-134570/

 

[wintermute000]

I don't get it. I googled and searched, can't find anything matching my error.
specs are in sig. OK version is 9.2.1.7

 

[Knowltey]

I linked you to the forum rules because your post has neglected to include all of the required information, primarily the information about what hardware you are running.

 

[wintermute000]

sig?

 

[Knowltey]

Users on mobile can't see the signature so you need to make sure to also include in in your post if you are looking for assistance.

 

[Ben Woods]

I am getting the same email alerts as wintermute000. As for hardware, I am using the FreeNAS mini (new model).

Anyone know what the problem could be, or how to assist in diagnosing it?

If it makes a difference, I am running plexmediaserver_plexpass in a portsjail


Sent from my iPhone using Tapatalk

 

[Ben Woods]

My message:

freenas.local kernel log messages:
arp: 192.168.1.2 moved from 02:31:77:00:08:0a to bc:5f:f4:fb:5e:9e on epair1b
arp: 192.168.1.2 moved from 02:31:77:00:08:0a to bc:5f:f4:fb:5e:9e on epair1b
arp: 192.168.1.2 moved from 02:31:77:00:08:0a to bc:5f:f4:fb:5e:9e on epair1b
arp: 192.168.1.2 moved from 02:31:77:00:08:0a to bc:5f:f4:fb:5e:9e on epair1b
igb0: link state changed to DOWN
igb0: link state changed to UP
igb0: link state changed to DOWN
igb0: link state changed to UP
igb0: link state changed to DOWN
igb0: link state changed to UP
-- End of security output --


Sent from my iPhone using Tapatalk

 

[wintermute000]

I think its safe to say its related to jails somehow. Though in your case you see LAN port flapping, I don't get that.

 

[Ben Woods]

It's worth noting that it is only sometimes I see the interface up/down message. Other times I just get the arp messages and nothing else.


Sent from my iPhone using Tapatalk

 

[dricetech]

Yes, this.
Sep 15 19:51:02 freenas kernel: arp: 192.168.1.117 moved from 02:e8:3d:00:0e:0a to 00:0c:29:af:5f:c6 on epair4b
Sep 15 19:51:02 freenas kernel: arp: 192.168.1.117 moved from 02:61:94:00:0d:0a to 00:0c:29:af:5f:c6 on epair3b
Sep 15 19:51:02 freenas kernel: arp: 192.168.1.117 moved from 02:14:6a:00:0c:0a to 00:0c:29:af:5f:c6 on epair2b
Sep 15 19:51:02 freenas kernel: arp: 192.168.1.117 moved from 02:75:c2:00:0b:0a to 00:0c:29:af:5f:c6 on epair1b
Sep 15 19:51:02 freenas kernel: arp: 192.168.1.117 moved from 02:11:6a:00:0a:0a to 00:0c:29:af:5f:c6 on epair0b

Constantly in my daily kernel reports sent to e-mail. Checked the MAC addresses, none of them match anything anywhere. The consistent one found is the virtual NIC's MAC address running to esxi.

SuperMicro X10sl7-F, Intel(R) Xeon(R) CPU E3-1230 v3 @ 3.30GHz, 32GB ECC RAM, 6x4TB WD RED NAS drives in raidz-2. 128 GB Kingston v300, 240 GB Kingston v300, 2x2TB WD Green Mirrored serving iSCSI. FreeNAS-9.2.1.7-RELEASE-x64 (fdbe9a0). 4GB Ram dedicated to FreeNAS VM.

 

[bloomo]

I was getting these too, I can't say for sure that this worked, but I moved the IP of my jail running Plex outside of the range of DHCP but still within my subnet and the messages seemed to chill out. A jail is assigned a IP (from the range specified in the jail config) so is effectively static, so this made sense to me. Hey, try it out! Maybe it will work for you. Now I only get those arp moved messages when I stop and start my jails. (I am by no means a network pro, so take this advice as such.)

 

[diedrichg]

*bump* I get these too and it's a bit annoying. What's the deal? Does anyone have an explanation?

 

[Dennis.kulmosen]

I am having these too. But in my case i have people direct connected with ethernet cable to the FreeNAS and each a machine reboots or a laptop gets disconnected, the log throws these messages. Its security related, the systems tells you that someone or something is messing with your network installation. if you know the cause it can be safely ignored.


Sent from my iPhone using Tapatalk

 

[subzer011]

i get these errors too....

Feb 2 08:46:49 freenas kernel: arp: 192.168.1.40 moved from 02:xx:xx:00:0f:0a to 00:25:xx:xx:00:00 on epair1b
Feb 2 08:46:49 freenas kernel: arp: 192.168.1.40 moved from 02:xx:xx:00:13:0a to 00:25:xx:xx:00:00 on epair5b
Feb 2 08:46:49 freenas kernel: arp: 192.168.1.40 moved from 02:xx:xx:00:12:0a to 00:25:xx:xx:00:00 on epair4b
Feb 2 08:46:49 freenas kernel: arp: 192.168.1.40 moved from 02:xx:xx:00:11:0a to 00:25:xx:xx:00:00 on epair3b
Feb 2 08:46:49 freenas kernel: arp: 192.168.1.40 moved from 02:xx:xx:00:10:0a to 00:25:xx:xx:00:00 on epair2b
Feb 2 08:46:49 freenas kernel: arp: 192.168.1.40 moved from 02:xx:xx:00:0e:0a to 00:25:xx:xx:00:00 on epair0b

the former set of MAC addresses belong to my jails. The latter belong to the physical NIC. the IP used by jails are outside of my router's DHCP pool--192.168.1.200 on up.

i'm using FreeNAS-9.3-STABLE-201501301837

Like wintermute000, i haven't noticed any loss in functionality either. But I do see them in the daily emails FreeNAS sends out

The server also has a 2nd NIC configured with a 192.168.2.40 IP, but I don't see any errors in the log associated with this IP nor its' MAC address.

 

[Balthasar Schopman]

I fixed this by doing the following, after reading a post on the freebsd forum:

Code:

echo 'net.link.ether.inet.log_arp_movements=0' >> /etc/sysctl.conf

and

Code:

sysctl -w net.link.ether.inet.log_arp_movements=0

No server reboot required.

 

[Plato]

This only suppresses the messages. Doesn't fix the underlying problem.

 

[depasseg]

Do you have multiple wireless access points?

 

[Chris Deluca]

I get them too:
Aug 6 18:44:27 freenas kernel: arp: 10.0.1.11 moved from c8:69:xx:xx:xx:xx to b8:8d:xx:xx:xx:xx on epair5b
Aug 6 18:45:18 freenas kernel: arp: 10.0.1.11 moved from b8:8d:xx:xx:xx:xx to c8:69:xx:xx:xx:xx on epair5b

They are coming from my Apple TV (based on the MAC address). Here is a note from the FreeBSD forum that I found when searching for this issue:

"...Another reason for the MAC address to change is using bonjour capable devices with a bonjour sleep proxy on the network. When the device goes to sleep, the sleep proxy (which is now responding on behalf of the sleeping machine) sends out a gratuitous ARP so that devices which try to contact the sleeping machine actually hit the sleep proxy (when then wakes the destination).
Sleep proxies are devices like Airport Express/Extreme and Apple TVs (low power, always on)..."

Could it be similar in nature to the Apple TV functionality (sleep proxy) but originating from a different source?