Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Strange arp moved messages

    Scheduled Pinned Locked Moved
    General pfSense Questions
    1
    1
    1.2k
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • E
      EddieA
      last edited by

      Hi,

      Currently running 2.0.1. nano version, and noticed these in my log from last night:

      Jun 6 23:31:10 	kernel: arp: 192.168.0.2 moved from 00:1f:c6:e4:9d:96 to d8:b3:77:1a:c3:f8 on vr0
Jun 6 23:31:24 	kernel: arp: 192.168.0.2 moved from d8:b3:77:1a:c3:f8 to 00:1f:c6:e4:9d:96 on vr0
Jun 6 23:34:57 	kernel: arp: 192.168.0.2 moved from 00:1f:c6:e4:9d:96 to d8:b3:77:1a:c3:f8 on vr0
Jun 6 23:35:22 	kernel: arp: 192.168.0.2 moved from d8:b3:77:1a:c3:f8 to 00:1f:c6:e4:9d:96 on vr0
Jun 6 23:44:01 	kernel: arp: 192.168.0.49 moved from 5c:ff:35:0d:b0:e6 to d8:b3:77:1a:c3:f8 on vr0
Jun 6 23:45:17 	kernel: arp: 192.168.0.49 moved from d8:b3:77:1a:c3:f8 to 5c:ff:35:0d:b0:e6 on vr0
Jun 6 23:46:48 	kernel: arp: 192.168.0.3 moved from 00:21:86:25:b4:84 to d8:b3:77:1a:c3:f8 on vr0
Jun 6 23:46:50 	kernel: arp: 192.168.0.3 moved from d8:b3:77:1a:c3:f8 to 00:21:86:25:b4:84 on vr0
Jun 6 23:48:49 	kernel: arp: 192.168.0.3 moved from 00:21:86:25:b4:84 to d8:b3:77:1a:c3:f8 on vr0
Jun 6 23:48:51 	kernel: arp: 192.168.0.3 moved from d8:b3:77:1a:c3:f8 to 00:21:86:25:b4:84 on vr0
Jun 6 23:50:49 	kernel: arp: 192.168.0.3 moved from 00:21:86:25:b4:84 to d8:b3:77:1a:c3:f8 on vr0
Jun 6 23:50:52 	kernel: arp: 192.168.0.3 moved from d8:b3:77:1a:c3:f8 to 00:21:86:25:b4:84 on vr0
Jun 7 00:01:09 	kernel: arp: 192.168.0.2 moved from 00:1f:c6:e4:9d:96 to d8:b3:77:1a:c3:f8 on vr0
Jun 7 00:01:25 	kernel: arp: 192.168.0.2 moved from d8:b3:77:1a:c3:f8 to 00:1f:c6:e4:9d:96 on vr0
Jun 7 00:03:41 	kernel: arp: 192.168.0.49 moved from 5c:ff:35:0d:b0:e6 to d8:b3:77:1a:c3:f8 on vr0
Jun 7 00:04:05 	kernel: arp: 192.168.0.49 moved from d8:b3:77:1a:c3:f8 to 5c:ff:35:0d:b0:e6 on vr0
Jun 7 00:13:31 	kernel: arp: 192.168.0.2 moved from 00:1f:c6:e4:9d:96 to d8:b3:77:1a:c3:f8 on vr0
Jun 7 00:13:38 	kernel: arp: 192.168.0.2 moved from d8:b3:77:1a:c3:f8 to 00:1f:c6:e4:9d:96 on vr0
Jun 7 00:16:02 	kernel: arp: 192.168.0.2 moved from 00:1f:c6:e4:9d:96 to d8:b3:77:1a:c3:f8 on vr0
Jun 7 00:16:24 	kernel: arp: 192.168.0.2 moved from d8:b3:77:1a:c3:f8 to 00:1f:c6:e4:9d:96 on vr0
Jun 7 00:17:02 	kernel: arp: 192.168.0.2 moved from 00:1f:c6:e4:9d:96 to d8:b3:77:1a:c3:f8 on vr0
Jun 7 00:17:05 	kernel: arp: 192.168.0.2 moved from d8:b3:77:1a:c3:f8 to 00:1f:c6:e4:9d:96 on vr0
Jun 7 00:24:36 	kernel: arp: 192.168.0.49 moved from 5c:ff:35:0d:b0:e6 to d8:b3:77:1a:c3:f8 on vr0
Jun 7 00:25:00 	kernel: arp: 192.168.0.49 moved from d8:b3:77:1a:c3:f8 to 5c:ff:35:0d:b0:e6 on vr0
Jun 7 00:33:25 	kernel: arp: 192.168.0.49 moved from 5c:ff:35:0d:b0:e6 to d8:b3:77:1a:c3:f8 on vr0
Jun 7 00:33:37 	kernel: arp: 192.168.0.49 moved from d8:b3:77:1a:c3:f8 to 5c:ff:35:0d:b0:e6 on vr0
Jun 7 00:34:26 	kernel: arp: 192.168.0.49 moved from 5c:ff:35:0d:b0:e6 to d8:b3:77:1a:c3:f8 on vr0
Jun 7 00:34:47 	kernel: arp: 192.168.0.49 moved from d8:b3:77:1a:c3:f8 to 5c:ff:35:0d:b0:e6 on vr0
Jun 7 00:53:50 	kernel: arp: 192.168.0.49 moved from 5c:ff:35:0d:b0:e6 to d8:b3:77:1a:c3:f8 on vr0
Jun 7 00:54:06 	kernel: arp: 192.168.0.2 moved from 00:1f:c6:e4:9d:96 to d8:b3:77:1a:c3:f8 on vr0
Jun 7 00:54:12 	kernel: arp: 192.168.0.2 moved from d8:b3:77:1a:c3:f8 to 00:1f:c6:e4:9d:96 on vr0
Jun 7 00:54:16 	kernel: arp: 192.168.0.49 moved from d8:b3:77:1a:c3:f8 to 5c:ff:35:0d:b0:e6 on vr0
Jun 7 00:56:01 	dhclient: RENEW
Jun 7 00:56:01 	dhclient: Creating resolv.conf
Jun 7 01:01:00 	php: : DynDns: updatedns() starting
Jun 7 01:01:00 	php: : DynDns debug information: 98.148.127.153 extracted from local system.
Jun 7 01:01:00 	php: : DynDns: Current WAN IP: 98.148.127.153 Cached IP: 98.148.127.153
Jun 7 01:01:00 	php: : phpDynDNS: No change in my IP address and/or 25 days has not passed. Not updating dynamic DNS entry.
Jun 7 01:08:43 	kernel: arp: 192.168.0.49 moved from 5c:ff:35:0d:b0:e6 to d8:b3:77:1a:c3:f8 on vr0
Jun 7 01:09:02 	kernel: arp: 192.168.0.49 moved from d8:b3:77:1a:c3:f8 to 5c:ff:35:0d:b0:e6 on vr0

      Now, I know the usual reason for the messages is an IP conflict within the network.  But for the life of me, I can't see how.

      All IP addresses on my network are handed out by pfSense.

      192.168.0.2 is a static IP assigned to 00:1f:c6:e4:9d:96.
      192.168.0.49 is a dynamic IP handed out to 5c:ff:35:0d:b0:e6, which was up and running throughout.
      d8:b3:77:1a:c3:f8 is the MAC address of my phone, which was assigned 192.168.0.40 by pfSense.

      Here are the relevant entries from the dhcpd log, for the handing out of IPs, and the time period shown above:

      Jun  6 20:16:28 roadblock dhcpd: DHCPREQUEST for 192.168.0.2 from 00:1f:c6:e4:9d:96 via vr0
Jun  6 20:16:28 roadblock dhcpd: DHCPACK on 192.168.0.2 to 00:1f:c6:e4:9d:96 via vr0
.
.
.
Jun  6 21:00:21 roadblock dhcpd: DHCPREQUEST for 192.168.0.49 from 5c:ff:35:0d:b0:e6 (IBM-4M3O3T8ZN88) via vr0
Jun  6 21:00:21 roadblock dhcpd: DHCPACK on 192.168.0.49 to 5c:ff:35:0d:b0:e6 (IBM-4M3O3T8ZN88) via vr0
.
.
.
Jun  6 23:28:52 roadblock dhcpd: DHCPDISCOVER from d8:b3:77:1a:c3:f8 via vr0
Jun  6 23:28:53 roadblock dhcpd: unexpected ICMP Echo Reply from 98.148.120.1
Jun  6 23:28:53 roadblock dhcpd: DHCPOFFER on 192.168.0.40 to d8:b3:77:1a:c3:f8 (android-a200a3a52473f194) via vr0
Jun  6 23:28:53 roadblock dhcpd: Wrote 0 deleted host decls to leases file.
Jun  6 23:28:53 roadblock dhcpd: Wrote 0 new dynamic host decls to leases file.
Jun  6 23:28:53 roadblock dhcpd: Wrote 23 leases to leases file.
Jun  6 23:28:53 roadblock dhcpd: DHCPREQUEST for 192.168.0.40 (192.168.0.55) from d8:b3:77:1a:c3:f8 (android-a200a3a52473f194) via vr0
Jun  6 23:28:53 roadblock dhcpd: DHCPACK on 192.168.0.40 to d8:b3:77:1a:c3:f8 (android-a200a3a52473f194) via vr0
Jun  6 23:30:37 roadblock dhcpd: DHCPINFORM from 192.168.0.3 via vr0
Jun  6 23:30:37 roadblock dhcpd: DHCPACK to 192.168.0.3 (00:21:86:25:b4:84) via vr0
Jun  6 23:31:42 roadblock dhcpd: DHCPINFORM from 192.168.0.3 via vr0
Jun  6 23:31:42 roadblock dhcpd: DHCPACK to 192.168.0.3 (00:21:86:25:b4:84) via vr0
Jun  6 23:33:38 roadblock dhcpd: DHCPINFORM from 192.168.0.3 via vr0
Jun  6 23:33:38 roadblock dhcpd: DHCPACK to 192.168.0.3 (00:21:86:25:b4:84) via vr0
Jun  6 23:34:43 roadblock dhcpd: DHCPINFORM from 192.168.0.3 via vr0
Jun  6 23:34:43 roadblock dhcpd: DHCPACK to 192.168.0.3 (00:21:86:25:b4:84) via vr0
Jun  6 23:36:39 roadblock dhcpd: DHCPINFORM from 192.168.0.3 via vr0
Jun  6 23:36:39 roadblock dhcpd: DHCPACK to 192.168.0.3 (00:21:86:25:b4:84) via vr0
Jun  6 23:37:42 roadblock dhcpd: DHCPINFORM from 192.168.0.3 via vr0
Jun  6 23:37:42 roadblock dhcpd: DHCPACK to 192.168.0.3 (00:21:86:25:b4:84) via vr0
Jun  6 23:38:44 roadblock dhcpd: DHCPINFORM from 192.168.0.3 via vr0
Jun  6 23:38:44 roadblock dhcpd: DHCPACK to 192.168.0.3 (00:21:86:25:b4:84) via vr0
Jun  6 23:40:39 roadblock dhcpd: DHCPINFORM from 192.168.0.3 via vr0
Jun  6 23:40:39 roadblock dhcpd: DHCPACK to 192.168.0.3 (00:21:86:25:b4:84) via vr0
Jun  6 23:41:44 roadblock dhcpd: DHCPINFORM from 192.168.0.3 via vr0
Jun  6 23:41:44 roadblock dhcpd: DHCPACK to 192.168.0.3 (00:21:86:25:b4:84) via vr0
Jun  6 23:43:40 roadblock dhcpd: DHCPINFORM from 192.168.0.3 via vr0
Jun  6 23:43:40 roadblock dhcpd: DHCPACK to 192.168.0.3 (00:21:86:25:b4:84) via vr0
Jun  6 23:44:45 roadblock dhcpd: DHCPINFORM from 192.168.0.3 via vr0
Jun  6 23:44:45 roadblock dhcpd: DHCPACK to 192.168.0.3 (00:21:86:25:b4:84) via vr0
Jun  6 23:46:41 roadblock dhcpd: DHCPINFORM from 192.168.0.3 via vr0
Jun  6 23:46:41 roadblock dhcpd: DHCPACK to 192.168.0.3 (00:21:86:25:b4:84) via vr0
Jun  6 23:47:46 roadblock dhcpd: DHCPINFORM from 192.168.0.3 via vr0
Jun  6 23:47:46 roadblock dhcpd: DHCPACK to 192.168.0.3 (00:21:86:25:b4:84) via vr0
Jun  6 23:49:42 roadblock dhcpd: DHCPINFORM from 192.168.0.3 via vr0
Jun  6 23:49:42 roadblock dhcpd: DHCPACK to 192.168.0.3 (00:21:86:25:b4:84) via vr0
Jun  6 23:50:47 roadblock dhcpd: DHCPINFORM from 192.168.0.3 via vr0
Jun  6 23:50:47 roadblock dhcpd: DHCPACK to 192.168.0.3 (00:21:86:25:b4:84) via vr0
Jun  6 23:52:41 roadblock dhcpd: DHCPINFORM from 192.168.0.3 via vr0
Jun  6 23:52:41 roadblock dhcpd: DHCPACK to 192.168.0.3 (00:21:86:25:b4:84) via vr0
Jun  6 23:53:42 roadblock dhcpd: DHCPINFORM from 192.168.0.3 via vr0
Jun  6 23:53:42 roadblock dhcpd: DHCPACK to 192.168.0.3 (00:21:86:25:b4:84) via vr0
Jun  6 23:54:47 roadblock dhcpd: DHCPINFORM from 192.168.0.3 via vr0
Jun  6 23:54:47 roadblock dhcpd: DHCPACK to 192.168.0.3 (00:21:86:25:b4:84) via vr0
Jun  6 23:55:32 roadblock dhcpd: DHCPINFORM from 192.168.0.49 via vr0
Jun  6 23:55:32 roadblock dhcpd: DHCPACK to 192.168.0.49 (5c:ff:35:0d:b0:e6) via vr0
Jun  6 23:55:47 roadblock dhcpd: DHCPINFORM from 192.168.0.3 via vr0
Jun  6 23:55:47 roadblock dhcpd: DHCPACK to 192.168.0.3 (00:21:86:25:b4:84) via vr0
Jun  6 23:57:43 roadblock dhcpd: DHCPINFORM from 192.168.0.3 via vr0
Jun  6 23:57:43 roadblock dhcpd: DHCPACK to 192.168.0.3 (00:21:86:25:b4:84) via vr0
Jun  6 23:58:48 roadblock dhcpd: DHCPINFORM from 192.168.0.3 via vr0
Jun  6 23:58:48 roadblock dhcpd: DHCPACK to 192.168.0.3 (00:21:86:25:b4:84) via vr0
Jun  7 01:28:53 roadblock dhcpd: DHCPREQUEST for 192.168.0.50 from 00:a0:c5:b9:b2:f0 via vr0
Jun  7 01:28:53 roadblock dhcpd: DHCPACK on 192.168.0.50 to 00:a0:c5:b9:b2:f0 via vr0
Jun  7 01:29:56 roadblock dhcpd: DHCPREQUEST for 192.168.0.54 from 00:a0:c5:b9:b2:5f via vr0
Jun  7 01:29:56 roadblock dhcpd: DHCPACK on 192.168.0.54 to 00:a0:c5:b9:b2:5f via vr0
Jun  7 01:42:11 roadblock dhcpd: DHCPREQUEST for 192.168.0.1 from 00:0c:29:e8:20:1a via vr0
Jun  7 01:42:11 roadblock dhcpd: DHCPACK on 192.168.0.1 to 00:0c:29:e8:20:1a via vr0
Jun  7 02:00:09 roadblock dhcpd: DHCPINFORM from 192.168.0.2 via vr0
Jun  7 02:00:09 roadblock dhcpd: DHCPACK to 192.168.0.2 (00:1f:c6:e4:9d:96) via vr0

      So, any ideas what's going on here.

      Cheers.

      1 Reply Last reply Reply Quote 0
      • First post
        Last post
      Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.