What causes this in the logs?

JBelthoff

Hi all,

I'm new to pfsense and am continually seeing this in the logs. It's all from the same IP4 machine. Can someone be kind enough to tell me how to fix this?


Jun 17 05:46:30 router kernel: arp: 10.150.150.12 moved from f0:79:59:38:29:e6 to f0:79:59:38:29:e5 on igb1
Jun 17 05:47:34 router kernel: arp: 10.150.150.12 moved from f0:79:59:38:29:e6 to f0:79:59:38:29:e5 on igb1
Jun 17 05:52:20 router kernel: arp: 10.150.150.12 moved from f0:79:59:38:29:e5 to f0:79:59:38:29:e6 on igb1
Jun 17 05:52:39 router kernel: arp: 10.150.150.12 moved from f0:79:59:38:29:e6 to f0:79:59:38:29:e5 on igb1
Jun 17 05:54:47 router kernel: arp: 10.150.150.12 moved from f0:79:59:38:29:e6 to f0:79:59:38:29:e5 on igb1
Jun 17 05:56:27 router kernel: arp: 10.150.150.12 moved from f0:79:59:38:29:e6 to f0:79:59:38:29:e5 on igb1
Jun 17 05:56:44 router kernel: arp: 10.150.150.12 moved from f0:79:59:38:29:e6 to f0:79:59:38:29:e5 on igb1
Jun 17 06:01:07 router kernel: arp: 10.150.150.12 moved from f0:79:59:38:29:e5 to f0:79:59:38:29:e6 on igb1
Jun 17 06:02:53 router kernel: arp: 10.150.150.12 moved from f0:79:59:38:29:e6 to f0:79:59:38:29:e5 on igb1
Jun 17 06:04:34 router kernel: arp: 10.150.150.12 moved from f0:79:59:38:29:e6 to f0:79:59:38:29:e5 on igb1
Jun 17 06:08:38 router kernel: arp: 10.150.150.12 moved from f0:79:59:38:29:e6 to f0:79:59:38:29:e5 on igb1
Jun 17 06:10:03 router kernel: arp: 10.150.150.12 moved from f0:79:59:38:29:e6 to f0:79:59:38:29:e5 on igb1
Jun 17 06:11:55 router kernel: arp: 10.150.150.12 moved from f0:79:59:38:29:e6 to f0:79:59:38:29:e5 on igb1
Jun 17 06:14:39 router kernel: arp: 10.150.150.12 moved from f0:79:59:38:29:e6 to f0:79:59:38:29:e5 on igb1
Jun 17 06:17:47 router kernel: arp: 10.150.150.12 moved from f0:79:59:38:29:e6 to f0:79:59:38:29:e5 on igb1

Thanks,

johnpoz

Mac for that IP changed.. What is 10.150.150.12? Does it have team nics or something?

JBelthoff

Yes, that is a windows machine with 2 nics teamed in adaptive load balanced configuration.

It is a windows 8.1 machine. Would I look there to fix this?

dotdash

Stop using nic teaming or ignore the log messages. You can also check a box under advanced, networking to supress arp messages.

johnpoz

easy fix would be to remove the team ;)

https://doc.pfsense.org/index.php/ARP_moved_log_messages

Or you could change the teaming method so it doesn't bounce back and forth so much.. What advantage do you think your getting with load balanced connection what I assume is a workstation if running 8.1 are they gig connections? Are you talking to stuff that get you over gig in bandwidth?

JBelthoff

Yes, I can always remove the team. However now I'm curious because I have a NAS that has an adaptive load balanced nic team with 2 nics. No log entries from that nic team - however that is running Linux. This machine has windows.

Interesting….

Thanks for the help! :-)