What is the meaning of this message received on e-mail

[dmoldovan]

Code:

freenas.local kernel log messages:
> arp: 192.168.1.2 moved from c4:ad:34:62:25:07 to c4:ad:34:62:25:0a on re0
> arp: 192.168.1.2 moved from c4:ad:34:62:25:0a to c4:ad:34:62:25:07 on re0
> arp: 192.168.1.2 moved from c4:ad:34:62:25:0a to c4:ad:34:62:25:07 on re0
> arp: 192.168.1.2 moved from c4:ad:34:62:25:0a to c4:ad:34:62:25:07 on re0
> arp: 192.168.1.2 moved from c4:ad:34:62:25:0a to c4:ad:34:62:25:07 on re0
> arp: 192.168.1.2 moved from c4:ad:34:62:25:0a to c4:ad:34:62:25:07 on re0
> arp: 192.168.1.2 moved from c4:ad:34:62:25:07 to c4:ad:34:62:25:0a on re0
> arp: 192.168.1.2 moved from c4:ad:34:62:25:07 to c4:ad:34:62:25:0a on re0
> arp: 192.168.1.2 moved from c4:ad:34:62:25:07 to c4:ad:34:62:25:0a on re0
> arp: 192.168.1.2 moved from c4:ad:34:62:25:07 to c4:ad:34:62:25:0a on re0
> arp: 192.168.1.2 moved from c4:ad:34:62:25:07 to c4:ad:34:62:25:0a on re0
> arp: 192.168.1.2 moved from c4:ad:34:62:25:07 to c4:ad:34:62:25:0a on re0
> arp: 192.168.1.2 moved from c4:ad:34:62:25:07 to c4:ad:34:62:25:0a on re0
> arp: 192.168.1.2 moved from c4:ad:34:62:25:07 to c4:ad:34:62:25:0a on re0
> arp: 192.168.1.2 moved from c4:ad:34:62:25:07 to c4:ad:34:62:25:0a on re0
> arp: 192.168.1.2 moved from c4:ad:34:62:25:07 to c4:ad:34:62:25:0a on re0
> arp: 192.168.1.2 moved from c4:ad:34:62:25:07 to c4:ad:34:62:25:0a on re0
> arp: 192.168.1.2 moved from c4:ad:34:62:25:0a to c4:ad:34:62:25:07 on re0
> arp: 192.168.1.2 moved from c4:ad:34:62:25:07 to c4:ad:34:62:25:0a on re0
> arp: 192.168.1.2 moved from c4:ad:34:62:25:0a to c4:ad:34:62:25:07 on re0
> arp: 192.168.1.2 moved from c4:ad:34:62:25:0a to c4:ad:34:62:25:07 on re0
> arp: 192.168.1.2 moved from c4:ad:34:62:25:0a to c4:ad:34:62:25:07 on re0
> arp: 192.168.1.2 moved from c4:ad:34:62:25:0a to c4:ad:34:62:25:07 on re0
> arp: 192.168.1.2 moved from c4:ad:34:62:25:0a to c4:ad:34:62:25:07 on re0

 

[sretalla]

It looks like the IP address 192.168.1.2 is moving around between 2 different devices... it could be that FreeNA owns those MAC addresses, but it will alert you if it sees other boxes messing around like that too.

Depending on your router/firewall platform, you may be able to look into it in the logs there. You may see the mapping of devices/names to MAC addresses in the DHCP tables there.

 

[dmoldovan]

192.168.1.2 is the internal IP address of my router

How can it change ????

I also (sometimes) get this message about the IP address of my main workstation .
BUT that workstation has STATIC assigned IP address.

Do you have any ideea why do I see this kind of behavior ?


Thanks,
Dan

 

[Yorick]

It moved to a different MAC. How it could change depends on how your router assigns that MAC.
It's also possible it moved to a different MAC because there is another device on the network that tries to use 1.2, giving you a conflict.

Same for your main workstation - is it inside the DHCP scope? If so, its static may conflict with another device that gets the same IP via DHCP.

Track down the MAC addresses, that'll tell you which devices these are.

 

[sretalla]

The first thing that could give you some kind of clue would be the MAC addresses... figure out which one is the router and which is the "other" one.

Then once you figure that out, you have some chance of understanding why it would be fighting over the IP address in the ARP table with the router.

You could use https://macvendors.com/ to help to understand the vendor of a NIC based on MAC address.

There are an awful lot of reasons why this could be happening... perhaps something to do with promiscuous mode being enabled by a device... I don't know your network and device list.

 

[dmoldovan]

The first thing that could give you some kind of clue would be the MAC addresses... figure out which one is the router and which is the "other" one.

Then once you figure that out, you have some chance of understanding why it would be fighting over the IP address in the ARP table with the router.

You could use https://macvendors.com/ to help to understand the vendor of a NIC based on MAC address.

There are an awful lot of reasons why this could be happening... perhaps something to do with promiscuous mode being enabled by a device... I don't know your network and device list.

Thanks a lot for your suggestion

My router is a Mikrotik router.

This is the only Mikrotik device that I have in my home. It is a Ethernet only (No-WiFi device)

And yet, both MAC addresses are being reported as belonging to Routerboard.com

They are the manufacturers of the Mikrotik boards.

As I said, I only have one piece of this equipment on the LAN.

To me this is very strange...

 

[dmoldovan]

It moved to a different MAC. How it could change depends on how your router assigns that MAC.
It's also possible it moved to a different MAC because there is another device on the network that tries to use 1.2, giving you a conflict.

Same for your main workstation - is it inside the DHCP scope? If so, its static may conflict with another device that gets the same IP via DHCP.

Track down the MAC addresses, that'll tell you which devices these are.

DHCP scope is from 192.168.1.100 to 192.168.1.200

 

[Redcoat]

Is thi in any way helpful? https://vswitchzero.com/2019/08/23/preventing-mikrotik-routeros-bridge-mac-changes/

 

[dmoldovan]

Is thi in any way helpful? https://vswitchzero.com/2019/08/23/preventing-mikrotik-routeros-bridge-mac-changes/

Thanks for pointing that out

After checking my situation I discovered that in my case, by default, there was no auto-mac, and there was an admin-mac setup already, as you can see in the attachment

 

[Redcoat]

Thanks for the update - I'll be following this thread because I am considering a mikrotik.

 

[dmoldovan]

Thanks for the update - I'll be following this thread because I am considering a mikrotik.

Welcome to this thread RedCoat