arp moved messages

[raidflex]

I keep receiving these messages in the console. It seems to happen on a daily basis, as I receive these errors in the daily emails sent. Please advise. Thanks

Nov 4 23:48:28 fileserver kernel: arp: 0.0.0.0 moved from xx:xx:xx:xx:xx:c0 to xx:xx:xx:xx:xx:52 on em0
Nov 4 23:56:44 fileserver kernel: arp: 0.0.0.0 moved from xx:xx:xx:xx:xx:52 to xx:xx:xx:xx:xx:c6 on em0
Nov 5 00:03:35 fileserver kernel: arp: 0.0.0.0 moved from xx:xx:xx:xx:xx:c6 to xx:xx:xx:xx:xx:52 on em0
Nov 5 16:28:36 fileserver kernel: arp: 0.0.0.0 moved from xx:xx:xx:xx:xx:52 to xx:xx:xx:xx:xx:5d on em0
Nov 5 16:28:50 fileserver kernel: arp: 0.0.0.0 moved from xx:xx:xx:xx:xx:5d to xx:xx:xx:xx:xx:35 on em0
Nov 5 16:29:22 fileserver kernel: arp: 0.0.0.0 moved from xx:xx:xx:xx:xx:35 to xx:xx:xx:xx:xx:c6 on em0
Nov 5 17:03:22 fileserver kernel: arp: 0.0.0.0 moved from xx:xx:xx:xx:xx:5d to xx:xx:xx:xx:xx:52 on em0
Nov 5 17:03:37 fileserver kernel: arp: 0.0.0.0 moved from xx:xx:xx:xx:xx:52 to xx:xx:xx:xx:xx:fa on em0

This usually goes on for a couple of hours.

 

[raidflex]

bump.. Anyone?

 

[tingo]

Usually, arp moved messages tells you that the hardware address (MAC) for a given IP address (on your local network) has changed. If you change netowrk cards in a machine for example, you will get one such message. Or if you have a machine with several network interfaces and that machine changes which interface it connects to the network (a laptop which changes between wireless and wired for example), you will get such messages.

If you get a lot of these messages without you changing anything on your network, it might indicate that one of the devices on the network is misbehaving.
You can use the IP address and mac address to find out which device / machine it is related to.

 

[raidflex]

The mac addresses are ones of other PCs and even a HP printer on my network. I am wondering if the server is just displaying PCs connecting and disconnecting from itself?

 

[cyberjock]

The mac addresses are ones of other PCs and even a HP printer on my network. I am wondering if the server is just displaying PCs connecting and disconnecting from itself?

I don't think so. It really sounds like something is misbehaving on your network.

 

[raidflex]

I don't think so. It really sounds like something is misbehaving on your network.

Would a jail setup with a MYSQL database be a possible cause? I did make sure that the IP of the jail was outside the DHCP range of the router.

 

[cyberjock]

Doubt it. Unless you did something really crazy(I can't think of how crazy you'd have to be) I don't think that's the cause. You're the only one with the problem so it sounds more like something is screwed up than a configuration issue. I'd probably start taking devices off the network one at a time and see if the messages stop. It could be your network switch causing the problem too.

 

[raidflex]

Doubt it. Unless you did something really crazy(I can't think of how crazy you'd have to be) I don't think that's the cause. You're the only one with the problem so it sounds more like something is screwed up than a configuration issue. I'd probably start taking devices off the network one at a time and see if the messages stop. It could be your network switch causing the problem too.

It's possible that my Netgear GS 108 switch is the problem, but I doubt it. I suspect possibly an older Dlink DGL-4300 router that I setup as an access point. It is the only device added recently, all other networking devices I have had for 6 months or longer without issues.

 

[Milhouse]

You're the only one with the problem so it sounds more like something is screwed up than a configuration issue.

I've also seen these messages, and I'm also running MySQL in a jail.

Not sure what causes these messages to appear. I rebooted my 8.3.0-RELEASE box a couple of days ago and I haven't seen the messages reappear yet. I did think it might be related to stopping/starting the jail, but haven't been able to confirm that. I'm running DHCP (dnsmasq) on a Raspberry Pi, and have also been switching a PC from my normal 192.168.0.x subnet to 192.168.1.x quite a bit lately while talking with an errant router, maybe that is also behind it.

 

[raidflex]

I've also seen these messages, and I'm also running MySQL in a jail.

Not sure what causes these messages to appear. I rebooted my 8.3.0-RELEASE box a couple of days ago and I haven't seen the messages reappear yet. I did think it might be related to stopping/starting the jail, but haven't been able to confirm that. I'm running DHCP (dnsmasq) on a Raspberry Pi, and have also been switching a PC from my normal 192.168.0.x subnet to 192.168.1.x quite a bit lately while talking with an errant router, maybe that is also behind it.

I am also on 8.3.0-RELEASE, I have rebooted the NAS multiple times but the messages always seem to come back. I did update a couple settings with my network last night and this morning the report did not have any messages, but only time will tell if they come back.

 

[tingo]

If the (MySQL) jail has networking, perhaps you could use the ifconfig command to check the MAC address? (look for the 'ether ...' line)
That way you could figure out if the MAC address changes when you restart the jail.
I haven't used jails myself, so I don't know how this works.

 

[raidflex]

If the (MySQL) jail has networking, perhaps you could use the ifconfig command to check the MAC address? (look for the 'ether ...' line)
That way you could figure out if the MAC address changes when you restart the jail.
I haven't used jails myself, so I don't know how this works.

I stopped and started the jail a couple of times and sure enough each time the mac address had changed.

 

[tingo]

Good. So now you need to find out if FreeBSD jails are designed to work this way, or if this is specific to the way they are set up in FreeNAS. Or just live with it.

 

[cyberjock]

https://support.freenas.org/ticket/1706

I put that ticket in, and it looks like the next RELEASE of FreeNAS will have a permanent MAC.

 

[tingo]

Nice! Thanks for letting us know.

 

[raidflex]

Good to hear that this will be fix in the next release.

I suspect that in the interim it should not be a major issue, as I have not had any other network issues.

 

[raidflex]

Has this been fixed in the latest FreeNAS 8.3.0-RELEASE-p1 - Bugfix Release?

 

[cyberjock]

I believe so but not 100% sure. 8.3.0 p1 says its revision is 12825, which is higher than r12695 the ticket closed to.

 

[fracai]

I don't think the revision is a guaranteed indicator that that commit made it to a specific release. With many projects, I'm not sure how FreeNAS is run, the revision is linked to trunk, but each release branch pulls specific commits from trunk. Or rather, revision numbers are globally unique, but each branch is likely to have a different revision number for head. In this case, the Milestone is set to 9.1.0, so I wouldn't expect to see the fix until that point.

 

[macxs]

Just want to tell you we found out where these messages come from.

A DHCP client sends a DHCP request with source address 0.0.0.0 because of the lack of a valid address. After the client uses the address it informes ARP of the change. No prob here.

On Cisco IOS 15 a feature named "IP device tracking" is enabled by default. This makes the switch periodically send out ARP probes with source address 0.0.0.0 to track IP/ARP changes. The time interval is 30s by default. Having many switches in the net, many switches send ARP probes with source address 0.0.0.0 and so the ARP entry of 0.0.0.0 changes frequently. THAT's what FreeNAS reports.
We also had (and still have) issues with DHCP that suffers from these probes. Without the messages of FreeNAS we probably wouldn't find out that fast what was causing this.

HTH.

Bye!