Sys log flooded with "arp: 00:25:90:44:11:e7 attempts to modify permanent entry"

wgstarks

I'm seeing this entry flooding my system log-

Jan 22 17:09:09	kernel		arp: 00:25:90:44:11:e7 attempts to modify permanent entry for 10.0.1.20 on em1
Jan 22 17:09:40	kernel		arp: 00:25:90:44:11:e7 attempts to modify permanent entry for 10.0.1.20 on em1
Jan 22 17:10:11	kernel		arp: 00:25:90:44:11:e7 attempts to modify permanent entry for 10.0.1.20 on em1
Jan 22 17:10:41	kernel		arp: 00:25:90:44:11:e7 attempts to modify permanent entry for 10.0.1.20 on em1
Jan 22 17:11:12	kernel		arp: 00:25:90:44:11:e7 attempts to modify permanent entry for 10.0.1.20 on em1
Jan 22 17:11:42	kernel		arp: 00:25:90:44:11:e7 attempts to modify permanent entry for 10.0.1.20 on em1
Jan 22 17:12:08	kernel		arp: 00:25:90:44:11:e7 attempts to modify permanent entry for 10.0.1.20 on em1
Jan 22 17:12:13	kernel		arp: 00:25:90:44:11:e7 attempts to modify permanent entry for 10.0.1.20 on em1

10.0.1.20 is my unRAID server. Not sure if something is misconfigured there or if it's my pfsense setup. Would appreciate any advice?

Derelict

So find the permanent ARP entry there and delete it if that is not what you want.

Usually in the DHCP static mapping as attached.

I have been doing this a long time and have never needed to use a static ARP entry. It's usually easier to just fix whatever conditions exist to make it "necessary."

![Screen Shot 2018-01-22 at 3.53.05 PM.png](/public/imported_attachments/1/Screen Shot 2018-01-22 at 3.53.05 PM.png)
![Screen Shot 2018-01-22 at 3.53.05 PM.png_thumb](/public/imported_attachments/1/Screen Shot 2018-01-22 at 3.53.05 PM.png_thumb)

Derelict

That or I suppose someone is trying to spoof ARP for an interface address. You would need to handle that in your switching gear.

Diagnostics > Packet Capture for ARP on that interface and see what you see.

wgstarks

Thanks. I set a reserved IP for en-0 on the unraid server and then bonded en-0 and en-1. I'm sure that's what is causing this problem. The MAC address shown in the log entry is for en-1 on the unraid server.

Just to be sure I've got it right, I just need to uncheck the ARP Table Static Entry option?

wgstarks

@Derelict:

That or I suppose someone is trying to spoof ARP for an interface address. You would need to handle that in your switching gear.

Diagnostics > Packet Capture for ARP on that interface and see what you see.

No. I think this is caused by my own ignorance. :D