Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Kernel: Arp moved from - to

    Scheduled Pinned Locked Moved General pfSense Questions
    26 Posts 10 Posters 19.9k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • J
      jasonlitka
      last edited by

      @cmb:

      @Jason:

      Do you have a Time Capsule or AirPort Extreme to go with the AppleTV?  If so, that is, unfortunately, normal.

      Wow, really? Why's that? Odd that effectively the symptoms of an IP conflict would be normal, but I recall seeing that once on my home network also between two Apple vendor MACs. Don't have a time capsule or AirPort Extreme, have 2 Apple TVs, a couple iPhones, couple iPads, couple MacBook Pros, and an iMac. At the time I didn't even have time to check which MAC went to which device, and it hasn't recurred so I haven't bothered digging into it.

      It's a "feature" and part of the Bonjour Sleep Proxy.

      http://support.apple.com/kb/HT3774

      Also:

      https://discussions.apple.com/thread/2160614
      http://blog.martinshouse.com/2009/11/apple-time-capsule-steals-ip-addresses.html?m=1
      http://en.usenet.digipedia.org/thread/16243/200/

      I can break anything.

      1 Reply Last reply Reply Quote 0
      • S
        serialdie
        last edited by

        @Jason:

        @cmb:

        @Jason:

        Do you have a Time Capsule or AirPort Extreme to go with the AppleTV?  If so, that is, unfortunately, normal.

        Wow, really? Why's that? Odd that effectively the symptoms of an IP conflict would be normal, but I recall seeing that once on my home network also between two Apple vendor MACs. Don't have a time capsule or AirPort Extreme, have 2 Apple TVs, a couple iPhones, couple iPads, couple MacBook Pros, and an iMac. At the time I didn't even have time to check which MAC went to which device, and it hasn't recurred so I haven't bothered digging into it.

        It's a "feature" and part of the Bonjour Sleep Proxy.

        http://support.apple.com/kb/HT3774

        Also:

        https://discussions.apple.com/thread/2160614
        http://blog.martinshouse.com/2009/11/apple-time-capsule-steals-ip-addresses.html?m=1
        http://en.usenet.digipedia.org/thread/16243/200/

        Ha! That makes sense.
        I have bonjour enable on my nas and thats the IP of the nas.

        Thanks.

        1 Reply Last reply Reply Quote 0
        • J
          joako
          last edited by

          @Jason:

          @cmb:

          @Jason:

          Do you have a Time Capsule or AirPort Extreme to go with the AppleTV?  If so, that is, unfortunately, normal.

          Wow, really? Why's that? Odd that effectively the symptoms of an IP conflict would be normal, but I recall seeing that once on my home network also between two Apple vendor MACs. Don't have a time capsule or AirPort Extreme, have 2 Apple TVs, a couple iPhones, couple iPads, couple MacBook Pros, and an iMac. At the time I didn't even have time to check which MAC went to which device, and it hasn't recurred so I haven't bothered digging into it.

          It's a "feature" and part of the Bonjour Sleep Proxy.

          http://support.apple.com/kb/HT3774

          Also:

          https://discussions.apple.com/thread/2160614
          http://blog.martinshouse.com/2009/11/apple-time-capsule-steals-ip-addresses.html?m=1
          http://en.usenet.digipedia.org/thread/16243/200/

          If we disable the sleep proxy "feature" on all the MACs will the errors go away?

          1 Reply Last reply Reply Quote 0
          • B
            bardelot
            last edited by

            If you just want those messages not to appear in the log add the system tunable "net.link.ether.inet.log_arp_movements" and set its value to 0.

            1 Reply Last reply Reply Quote 0
            • J
              jasonlitka
              last edited by

              @joako:

              If we disable the sleep proxy "feature" on all the MACs will the errors go away?

              No. The issue is with the TC and AE, not the Macs, and you can't disable that feature on them.

              @bardelot:

              If you just want those messages not to appear in the log add the system tunable "net.link.ether.inet.log_arp_movements" and set its value to 0.

              I actually think the Suppress ARP messages setting will do it as well. If memory serves I didn't add a manual tunable.

              I can break anything.

              1 Reply Last reply Reply Quote 0
              • B
                bardelot
                last edited by

                @Jason:

                I actually think the Suppress ARP messages setting will do it as well. If memory serves I didn't add a manual tunable.

                Yes it sets the same tunable and also net.link.ether.inet.log_arp_wrong_iface="0" .

                1 Reply Last reply Reply Quote 0
                • T
                  tojoski
                  last edited by

                  This is happening on my Home Server as well.. I have 2 Gigabit Ethernet ports that are teamed to a single connection.

                  Feb 5 12:33:22

                  kernel: arp: 10.1.1.5 moved from 00:e0:81:ba:57:c4 to 00:e0:81:ba:57:c5 on em0

                  Feb 5 12:33:22

                  kernel: arp: 10.1.1.5 moved from 00:e0:81:ba:57:c5 to 00:e0:81:ba:57:c4 on em0

                  Will this create an issue? It seems to be working ok

                  1 Reply Last reply Reply Quote 0
                  • C
                    cmb
                    last edited by

                    @tojoski:

                    This is happening on my Home Server as well.. I have 2 Gigabit Ethernet ports that are teamed to a single connection.

                    Feb 5 12:33:22

                    kernel: arp: 10.1.1.5 moved from 00:e0:81:ba:57:c4 to 00:e0:81:ba:57:c5 on em0

                    Feb 5 12:33:22

                    kernel: arp: 10.1.1.5 moved from 00:e0:81:ba:57:c5 to 00:e0:81:ba:57:c4 on em0

                    Will this create an issue? It seems to be working ok

                    That's a different scenario, that's what you see when using certain types of NIC bonding. It's fine.

                    1 Reply Last reply Reply Quote 0
                    • J
                      joako
                      last edited by

                      @Jason:

                      @joako:

                      If we disable the sleep proxy "feature" on all the MACs will the errors go away?

                      No. The issue is with the TC and AE, not the Macs, and you can't disable that feature on them.

                      @bardelot:

                      If you just want those messages not to appear in the log add the system tunable "net.link.ether.inet.log_arp_movements" and set its value to 0.

                      I actually think the Suppress ARP messages setting will do it as well. If memory serves I didn't add a manual tunable.

                      I don't have any Time Capsule or Airport Express. Only Apple TV, 2x MacBook that are here sometimes and probably a few PCs with iTunes installed, if that matters.

                      But I still get the errors in the pfSense log.

                      1 Reply Last reply Reply Quote 0
                      • C
                        cmb
                        last edited by

                        @joako:

                        I don't have any Time Capsule or Airport Express. Only Apple TV, 2x MacBook that are here sometimes and probably a few PCs with iTunes installed, if that matters.

                        But I still get the errors in the pfSense log.

                        You don't need either of those, anything with the sleep proxy does it.

                        1 Reply Last reply Reply Quote 0
                        • X
                          xbipin
                          last edited by

                          isnt this arp moved thing related to using wifi repeaters?

                          1 Reply Last reply Reply Quote 0
                          • C
                            cmb
                            last edited by

                            @xbipin:

                            isnt this arp moved thing related to using wifi repeaters?

                            Most often, no. It can be. Some of them will translate the source MAC, which if someone roams from one wifi repeater to another will generate this kind of log.

                            1 Reply Last reply Reply Quote 0
                            • X
                              xbipin
                              last edited by

                              if so then wouldnt it cause issues with internet drops when a static dhcp lease is set with static arp for a client wifi mac id

                              1 Reply Last reply Reply Quote 0
                              • C
                                cmb
                                last edited by

                                @xbipin:

                                if so then wouldnt it cause issues with internet drops when a static dhcp lease is set with static arp for a client wifi mac id

                                It shouldn't. The DHCP requests should be relayed so the DHCP server still gets the client's actual MAC. Otherwise only one client behind the repeater would work on DHCP.

                                1 Reply Last reply Reply Quote 0
                                • X
                                  xbipin
                                  last edited by

                                  well i have a problem with the same, i have bridged lan to wifi on pfsense and static mac id/ip pairs set with static arp and deny unknown client ticked, i use a tp link TL-WA850RE wifi range entender and wifi clients get the proper ip but with staic arp wifi clients r not able to surf at all untill i untick that, any solution to this

                                  1 Reply Last reply Reply Quote 0
                                  • First post
                                    Last post
                                  Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.