Please help me understand this log entry

cwagz

May 4 18:33:33 kernel: arp: 192.168.x.xxx moved from 98:d6:bb:xx:xx:30 to 24:a2:e1:xx:xx:e3 on igb1
May 4 18:33:11 kernel: arp: 192.168.x.xxx moved from 24:a2:e1:xx:xx:e3 to 98:d6:bb:xx:xx:30 on igb1

Basically these are showing up constantly in my system log. It is the IP address of one of my AppleTVs and the AirPort Extreme it is connected to via wired ethernet.

What would be causing the arp to change between the actual device and then back to the airport over and over again? My log is basically full of these entries.

Any help is appreciated.

Thanks,
Chad

Derelict

I think there's something funky in the airport. It looks like there's an IP address conflict (two devices using the same IP address) but I thoroughly investigated a while back and I think the airport is doing some proxy arp or something. I have never seen anything adverse connectivity-wise.

(why are you obfuscating your private IP addresses?)

cwagz

@Derelict:

(why are you obfuscating your private IP addresses?)

Mainly because I was unsure if I should or not. I could not figure out why I would need to but I figured better to go ahead and do it. I will not in the future. Thank you for the reply. I will not worry about the log entry or whatever weirdness the airport is doing.

I already noticed that with cheap wireless access points. One of the mac addresses is the ethernet interface, and the other one is the wireless interface of the AP. But it doesn't really matter because those two macs are connected to the same switch port.

tim.mcmanus

If you have an Apple Airport and AppleTVs, this error is common and you will see it frequently. I'm not sure what the root cause is, but I have the same error with the same products on my LAN.

Everything should work seamlessly regardless of the error. I usually ignore it.

almabes

I see it on a customer network with Apple TVs, as well. I may load arpwatch on their firewall just for fun and games.

bearda

This is REALLY common for sites with multiple pieces of Apple gear, but not terribly well understood. From what I can tell it's related to the Bonjour Sleep Proxy feature:

http://en.wikipedia.org/wiki/Bonjour_Sleep_Proxy

Some pieces of Apple gear that go into a low power mode can ask another device on the network to remember what services it provides, and wake it up when someone asks for them. The low power device goes to sleep, and then the device that stays awake (probably your router in this case) assumes the identity of the other device. Since your router is seeing the IP used by the AppleTV change from the MAC address of the AppleTV to the MAC address of your AirPort its a little confused.

I recommend setting the System->Advanced->Networking->Suppress ARP messages option in these cases to void your logged getting spammed.

cwagz

@bearda:

This is REALLY common for sites with multiple pieces of Apple gear, but not terribly well understood. From what I can tell it's related to the Bonjour Sleep Proxy feature:

http://en.wikipedia.org/wiki/Bonjour_Sleep_Proxy

Some pieces of Apple gear that go into a low power mode can ask another device on the network to remember what services it provides, and wake it up when someone asks for them. The low power device goes to sleep, and then the device that stays awake (probably your router in this case) assumes the identity of the other device. Since your router is seeing the IP used by the AppleTV change from the MAC address of the AppleTV to the MAC address of your AirPort its a little confused.

I recommend setting the System->Advanced->Networking->Suppress ARP messages option in these cases to void your logged getting spammed.

Thank you. This would seem to explain it.