Kernel: arp: … moved from ... to ...

dstroot

This is all over my system log (pfsense 2.1.3 on ALIX):


Last 50 system log entries
May 3 17:25:58	kernel: arp: 192.168.15.90 moved from 10:40:f3:e7:91:fc to 88:1f:a1:2c:37:f0 on vr0
May 3 17:25:23	kernel: arp: 192.168.15.90 moved from 88:1f:a1:2c:37:f0 to 10:40:f3:e7:91:fc on vr0
May 3 17:16:08	kernel: arp: 192.168.15.90 moved from 10:40:f3:e7:91:fc to 88:1f:a1:2c:37:f0 on vr0
May 3 17:15:33	kernel: arp: 192.168.15.90 moved from 88:1f:a1:2c:37:f0 to 10:40:f3:e7:91:fc on vr0
May 3 17:06:15	kernel: arp: 192.168.15.90 moved from 10:40:f3:e7:91:fc to 88:1f:a1:2c:37:f0 on vr0
May 3 17:05:41	kernel: arp: 192.168.15.90 moved from 88:1f:a1:2c:37:f0 to 10:40:f3:e7:91:fc on vr0
May 3 16:56:20	kernel: arp: 192.168.15.90 moved from 10:40:f3:e7:91:fc to 88:1f:a1:2c:37:f0 on vr0
May 3 16:55:45	kernel: arp: 192.168.15.90 moved from 88:1f:a1:2c:37:f0 to 10:40:f3:e7:91:fc on vr0
May 3 16:46:24	kernel: arp: 192.168.15.90 moved from 10:40:f3:e7:91:fc to 88:1f:a1:2c:37:f0 on vr0
May 3 16:45:50	kernel: arp: 192.168.15.90 moved from 88:1f:a1:2c:37:f0 to 10:40:f3:e7:91:fc on vr0
May 3 16:36:33	kernel: arp: 192.168.15.90 moved from 10:40:f3:e7:91:fc to 88:1f:a1:2c:37:f0 on vr0
May 3 16:35:58	kernel: arp: 192.168.15.90 moved from 88:1f:a1:2c:37:f0 to 10:40:f3:e7:91:fc on vr0
May 3 16:26:40	kernel: arp: 192.168.15.90 moved from 10:40:f3:e7:91:fc to 88:1f:a1:2c:37:f0 on vr0
May 3 16:26:05	kernel: arp: 192.168.15.90 moved from 88:1f:a1:2c:37:f0 to 10:40:f3:e7:91:fc on vr0
May 3 16:16:45	kernel: arp: 192.168.15.90 moved from 10:40:f3:e7:91:fc to 88:1f:a1:2c:37:f0 on vr0
May 3 16:16:10	kernel: arp: 192.168.15.90 moved from 88:1f:a1:2c:37:f0 to 10:40:f3:e7:91:fc on vr0

I HAVE searched for the answer and from what I can tell it indicates two different MAC addresses using the same IP address.

In my case MAC address 10:40:f3:e7:91:fc is an Apple TV and is picking it's address up via DHCP on a wired connection.


Last 50 DHCP service log entries
May 3 17:35:12	dhcpd: DHCPACK on 192.168.15.90 to 10:40:f3:e7:91:fc (Apple-TV-2) via vr0
May 3 17:35:12	dhcpd: DHCPREQUEST for 192.168.15.90 from 10:40:f3:e7:91:fc (Apple-TV-2) via vr0
May 3 17:35:12	dhcpd: DHCPACK on 192.168.15.90 to 10:40:f3:e7:91:fc (Apple-TV-2) via vr0

and MAC address 88:1f:a1:2c:37:f0 is my Airport Time Capsule which has a static DHCP mapping to IP address 192.168.15.2 and shows up properly in my DHCP status page.

So I'm confused and need your help! Any and all advice cheerfully welcome! Thanks

cmb

That's from Bonjour Sleep Proxy. Normally that indicates an IP conflict or other issue, it's safe to ignore when it's switching between different Apple devices.

dstroot

OK - thanks. Looks weird and I was pulling what little hair I have left out. ;D

jasonlitka

@cmb:

That's from Bonjour Sleep Proxy. Normally that indicates an IP conflict or other issue, it's safe to ignore when it's switching between different Apple devices.

These messages spam the logs constantly when using Apple devices. I typically recommend enabling the "Suppress ARP messages" option when using pfSense at home with all devices on DHCP.

heper

it's a 'feature" from our fruity friends ;)