ARP Messages
-
Sep 19 11:16:49 kernel arp: 192.168.1.45 moved from 58:55:ca:5d:59:d4 to c8:69:cd:23:f3:ed on em1
Sep 19 11:17:01 kernel arp: 192.168.1.45 moved from c8:69:cd:23:f3:ed to 58:55:ca:5d:59:d4 on em1I'm getting a flood of messages like the two above in the System Log.
Devices:
58:55:ca:5d:59:d4 - Statically assigned to 192.168.1.41 (in DHCP server) - this is the wireless interface of an Apple TV (2nd Gen)
c8:69:cd:23:f3:ed - Statically assigned to 192.168.1.45 (in DHCP server) - this is the WIRED interface of a different Apple TV (3rd Gen)How is it that 192.168.1.45 is being assigned to both of these devices, bouncing back and forth?
They're not even the same device.. they're two physically different devices.Any ideas? Thanks!
EDIT –--
In the DHCP log, I'm getting the following messages:
Sep 19 11:27:11 dhcpd uid lease 192.168.1.162 for client c8:69:cd:23:f3:ed is duplicate on 192.168.1.0/24
Sep 19 11:27:11 dhcpd DHCPREQUEST for 192.168.1.45 from c8:69:cd:23:f3:ed via em1
Sep 19 11:27:11 dhcpd DHCPACK on 192.168.1.45 to c8:69:cd:23:f3:ed via em1
Sep 19 11:28:11 dhcpd uid lease 192.168.1.162 for client c8:69:cd:23:f3:ed is duplicate on 192.168.1.0/24
Sep 19 11:28:11 dhcpd DHCPREQUEST for 192.168.1.45 from c8:69:cd:23:f3:ed via em1
Sep 19 11:28:11 dhcpd DHCPACK on 192.168.1.45 to c8:69:cd:23:f3:ed via em1 -
clear you old leases for these IPs.. It possible its trying to renew its old lease, etc.
-
Ok, I did that (by editing the dhcpd.leases file) - is that the preferred method?
I actually cleared all the leases from that file - left it basically empty.
Restarted the DHCP server and the messages continued to come in (same ones as in original post).
The only one I'm not getting now is the mention of a duplicate record (see above). -
So your still getting these?
Sep 19 11:16:49 kernel arp: 192.168.1.45 moved from 58:55:ca:5d:59:d4 to c8:69:cd:23:f3:ed on em1
Sep 19 11:17:01 kernel arp: 192.168.1.45 moved from c8:69:cd:23:f3:ed to 58:55:ca:5d:59:d4 on em1Then you have a dupe IP.. I would go to each device and verify they are not set to static IP or have left over IP.. on that 1.45 address..
-
Yeah, I'm getting those still.. except it's a little bit different.
I shuffled around some of my static IP mappings in the DHCP server so to keep devices with more than one interface (wired / wireless) contiguous.So I'm now getting:
Sep 19 14:10:17 kernel arp: 192.168.1.44 moved from 58:55:ca:5d:59:d4 to c8:69:cd:23:f3:ed on em1
Sep 19 14:10:22 kernel arp: 192.168.1.44 moved from c8:69:cd:23:f3:ed to 58:55:ca:5d:59:d4 on em1Same two MAC addresses, but now their fighting over 192.168.1.44 .. So I don't think I have a dupe, because if one of them was static at 45 it wouldn't even be asking for a new one, right?
-
So you have devices with wired and wireless connections at the same time??
-
No no, I just meant devices that have two interfaces I setup in order (IP addresses).
They don't use both interfaces at the same time. For example, the one Apple TV is hard-wired, so I don't connect the wireless interface.
The other Apple TV is too far away from any ethernet drops, so it's connected wireless.These are the two interfaces that keep fighting over the same IP address… the wired on one device, and the wireless on the other device.
-
What if you just remove your reservations and let them get their own IPs and don't try to push them to something specific… What do they get now.. Look in your leases and see what each mac got..
-
I deleted the static mapping and restarted the DHCP service..
Now they're fighting over the first IP address in the servers range:Sep 19 14:42:57 kernel arp: 192.168.1.150 moved from c8:69:cd:23:f3:ed to 58:55:ca:5d:59:d4 on em1
Sep 19 14:43:45 kernel arp: 192.168.1.150 moved from 58:55:ca:5d:59:d4 to c8:69:cd:23:f3:ed on em1 -
hmmmm.. That is odd.. Can you draw up your network. So if you leave one off.. And log its dhcp via a sniff, it gets the first IP in your pool.. Then turn on your second device and sniff your dhcp it does a discover and pfsense hands it what IP - the same IP?? That should be impossible if first client got a lease for .150..
Your going to want to download the sniffs into wireshark so you can see what gets asked for if anything, and what gets offered, etc. Also make sure you validate that your first 1 gets a lease for the .150 or whatever other IP it gets, etc..
And your 100% sure these are mac of the devices, 1 is not the mac of say some wireless router/ap/range extender, etc.
I want to validate your clients are getting different ips via dhcp.. If so then you got some sort of loop in your network, which is why would like to see a drawing of your network?
I would assume something like this
pfsense - switch – AP ~~~~ wifi device
Where your wired device hangs off the switch. And then you have what as your AP?
-
I appreciate your help and suggestions.
All of this is happening on my home network, but I'm currently out of town for work for the next 2 weeks.
I've been monitoring the network through pfSense remotely.In order to make sure all the MACs are exactly what I say they are, I'm going to have to get to the network page of the Apple TVs and verify.
So, until I can get home, I'll have to wait on this one.
I will however let you know what I find once I get home.
-
I know exactly how it is.. I am on the road for work myself. Let me know when you get back. I am curious to what is going on that is for sure.
