Lots of IP Conflicts.



  • I've recently built and installed  PFSense box that is hooked up to our network. Things with this box were fine until I disabled our main DHCP server and enabled the DHCP server provided by PFSense.

    This is when all the IP Conflicts started. I see lots of these messages below. There is a problem but I am not sure what the problem is. There are no other DHCP servers on the network either.

    Time Process PID Message
    May 30 18:35:41 kernel arp: 192.168.20.25 moved from d4:ca:6d:74:92:8a to 7c:01:91:6d:8f:cc on re2
    May 30 18:35:42 kernel arp: 192.168.20.27 moved from d4:ca:6d:74:92:8a to ec:35:86:30:c8:1c on re2
    May 30 18:35:45 kernel arp: 192.168.240.95 moved from bc:34:00:c0:04:0d to d4:ca:6d:74:92:8a on re2
    May 30 18:35:48 kernel arp: 192.168.20.29 moved from d4:ca:6d:74:92:8a to 10:dd:b1:e7:0e:0b on re2
    May 30 18:35:49 kernel arp: 192.168.20.34 moved from d4:ca:6d:74:92:8a to 68:5b:35:7e:64:fd on re2
    May 30 18:35:53 kernel arp: 192.168.240.95 moved from bc:34:00:c0:04:0d to d4:ca:6d:74:92:8a on re2
    May 30 18:35:54 kernel arp: 192.168.240.33 moved from 98:f1:70:92:58:9b to d4:ca:6d:74:92:8a on re2
    May 30 18:35:59 kernel arp: 192.168.20.37 moved from d4:ca:6d:74:92:8a to 70:48:0f:98:ae:f8 on re2
    May 30 18:36:01 kernel arp: 192.168.20.39 moved from d4:ca:6d:74:92:8a to 68:5b:35:88:b0:36 on re2
    May 30 18:36:02 kernel arp: 192.168.240.30 moved from 78:bd:bc:66:c4:06 to d4:ca:6d:74:92:8a on re2
    May 30 18:36:04 kernel arp: 192.168.240.48 moved from d4:ca:6d:74:92:8a to 08:ed:b9:61:73:55 on re2
    May 30 18:36:05 kernel arp: 192.168.240.38 moved from 18:67:b0:b1:e0:12 to d4:ca:6d:74:92:8a on re2
    May 30 18:36:07 kernel arp: 192.168.20.43 moved from d4:ca:6d:74:92:8a to 10:dd:b1:e7:0e:0b on re2
    May 30 18:36:08 kernel arp: 192.168.20.46 moved from d4:ca:6d:74:92:8a to 10:dd:b1🆎79:ac on re2
    May 30 18:36:09 kernel arp: 192.168.20.47 moved from d4:ca:6d:74:92:8a to 68:5b:35:8a:49:d7 on re2
    May 30 18:36:11 kernel arp: 192.168.240.75 moved from 00:c0:b7:f6:6f:43 to d4:ca:6d:74:92:8a on re2
    May 30 18:36:12 kernel arp: 192.168.20.48 moved from d4:ca:6d:74:92:8a to 02:ff:70:00:0a:0b on re2
    May 30 18:36:15 kernel arp: 192.168.20.50 moved from d4:ca:6d:74:92:8a to 8c:2d:aa:44:e0:af on re2
    May 30 18:36:17 kernel arp: 192.168.20.52 moved from d4:ca:6d:74:92:8a to 70:48:0f:98:ae:f8 on re2
    May 30 18:36:18 kernel arp: 192.168.20.2 moved from d4:ca:6d:74:92:8a to 30:8c:fb:54:e6:11 on re2
    May 30 18:36:19 kernel arp: 192.168.20.53 moved from d4:ca:6d:74:92:8a to 68:5b:35:88:b0:36 on re2
    May 30 18:36:21 kernel arp: 192.168.20.55 moved from d4:ca:6d:74:92:8a to 7c:01:91:6d:8f:cc on re2
    May 30 18:36:23 kernel arp: 192.168.20.56 moved from d4:ca:6d:74:92:8a to 68:5b:35:7e:64:fd on re2
    May 30 18:36:25 kernel arp: 192.168.240.33 moved from d4:ca:6d:74:92:8a to 98:f1:70:92:58:9b on re2
    May 30 18:36:26 kernel arp: 192.168.20.58 moved from d4:ca:6d:74:92:8a to 8c:2d:aa:5d:c2:d7 on re2
    May 30 18:36:28 kernel arp: 192.168.20.60 moved from d4:ca:6d:74:92:8a to 10:dd:b1🆎79:ac on re2
    May 30 18:36:31 kernel arp: 192.168.20.62 moved from d4:ca:6d:74:92:8a to 70:48:0f:98:ae:f8 on re2
    May 30 18:36:33 kernel arp: 192.168.20.63 moved from d4:ca:6d:74:92:8a to f4:f9:51:e8:51:d6 on re2
    May 30 18:36:35 kernel arp: 192.168.20.65 moved from d4:ca:6d:74:92:8a to f4:f9:51:e8:51:ca on re2
    May 30 18:36:38 kernel arp: 192.168.20.67 moved from d4:ca:6d:74:92:8a to 68:5b:35:88:b0:36 on re2
    May 30 18:36:41 kernel arp: 192.168.20.69 moved from d4:ca:6d:74:92:8a to 68:5b:35:7e:64:fd on re2
    May 30 18:36:45 kernel arp: 192.168.20.70 moved from d4:ca:6d:74:92:8a to 10:dd:b1:e7:0e:0b on re2
    May 30 18:36:46 kernel arp: 192.168.20.72 moved from d4:ca:6d:74:92:8a to 10:dd:b1🆎79:ac on re2
    May 30 18:36:48 kernel arp: 192.168.20.75 moved from d4:ca:6d:74:92:8a to 70:48:0f:98:ae:f8 on re2



  • The MAC address d4:ca:6d:74:92:8a is for a device built by RouterBoard.  Was this your old DHCP server or some other device?  It appears to be spoofing a lot of your DHCP address range IPs.



  • @KOM:

    The MAC address d4:ca:6d:74:92:8a is for a device built by RouterBoard.  Was this your old DHCP server or some other device?  It appears to be spoofing a lot of your DHCP address range IPs.

    Yeah whatever that device is has a problem. Looks like it's proxy ARPing everything on the network.