What causes this in the logs?



  • Hi all,

    I'm new to pfsense and am continually seeing this in the logs. It's all from the same IP4 machine. Can someone be kind enough to tell me how to fix this?

    
    Jun 17 05:46:30 router kernel: arp: 10.150.150.12 moved from f0:79:59:38:29:e6 to f0:79:59:38:29:e5 on igb1
    Jun 17 05:47:34 router kernel: arp: 10.150.150.12 moved from f0:79:59:38:29:e6 to f0:79:59:38:29:e5 on igb1
    Jun 17 05:52:20 router kernel: arp: 10.150.150.12 moved from f0:79:59:38:29:e5 to f0:79:59:38:29:e6 on igb1
    Jun 17 05:52:39 router kernel: arp: 10.150.150.12 moved from f0:79:59:38:29:e6 to f0:79:59:38:29:e5 on igb1
    Jun 17 05:54:47 router kernel: arp: 10.150.150.12 moved from f0:79:59:38:29:e6 to f0:79:59:38:29:e5 on igb1
    Jun 17 05:56:27 router kernel: arp: 10.150.150.12 moved from f0:79:59:38:29:e6 to f0:79:59:38:29:e5 on igb1
    Jun 17 05:56:44 router kernel: arp: 10.150.150.12 moved from f0:79:59:38:29:e6 to f0:79:59:38:29:e5 on igb1
    Jun 17 06:01:07 router kernel: arp: 10.150.150.12 moved from f0:79:59:38:29:e5 to f0:79:59:38:29:e6 on igb1
    Jun 17 06:02:53 router kernel: arp: 10.150.150.12 moved from f0:79:59:38:29:e6 to f0:79:59:38:29:e5 on igb1
    Jun 17 06:04:34 router kernel: arp: 10.150.150.12 moved from f0:79:59:38:29:e6 to f0:79:59:38:29:e5 on igb1
    Jun 17 06:08:38 router kernel: arp: 10.150.150.12 moved from f0:79:59:38:29:e6 to f0:79:59:38:29:e5 on igb1
    Jun 17 06:10:03 router kernel: arp: 10.150.150.12 moved from f0:79:59:38:29:e6 to f0:79:59:38:29:e5 on igb1
    Jun 17 06:11:55 router kernel: arp: 10.150.150.12 moved from f0:79:59:38:29:e6 to f0:79:59:38:29:e5 on igb1
    Jun 17 06:14:39 router kernel: arp: 10.150.150.12 moved from f0:79:59:38:29:e6 to f0:79:59:38:29:e5 on igb1
    Jun 17 06:17:47 router kernel: arp: 10.150.150.12 moved from f0:79:59:38:29:e6 to f0:79:59:38:29:e5 on igb1
    
    

    Thanks,


  • LAYER 8 Global Moderator

    Mac for that IP changed..  What is 10.150.150.12?  Does it have team nics or something?



  • Yes, that is a windows machine with 2 nics teamed in adaptive load balanced configuration.

    It is a windows 8.1 machine. Would I look there to fix this?



  • Stop using nic teaming or ignore the log messages. You can also check a box under advanced, networking to supress arp messages.


  • LAYER 8 Global Moderator

    easy fix would be to remove the team ;)

    https://doc.pfsense.org/index.php/ARP_moved_log_messages

    Or you could change the teaming method so it doesn't bounce back and forth so much..  What advantage do you think your getting with load balanced connection what I assume is a workstation if running 8.1 are they gig connections?  Are you talking to stuff that get you over gig in bandwidth?



  • Yes, I can always remove the team. However now I'm curious because I have a NAS that has an adaptive load balanced nic team with 2 nics. No log entries from that nic team - however that is running Linux. This machine has windows.

    Interesting….

    Thanks for the help! :-)


Log in to reply