arp moved messages

[warri]

Awesome, I always wondered where those came from.

 

[aplats]

I'm sorry for reviving a dead thread, however, I've ran into this issue when there is nothing configured wrong (that I can tell), and I wanted to share how to silence these messages. One of the causes of this could be bridging multiple interfaces. So you may see it with some jails, depending on your configuration.

Try creating a sysctl called net.link.ether.inet.log_arp_movements and set its value to 0. This was helpful for me since it was cluttering the console log.

 

[joeschmuck]

@aplats
Thanks for the information, I set the variable and hopefully those messages go away. I get at least two of these arp messages almost every day. They are from my network and I suspect it's from the cell phones being on my WiFi network. They come and they go. The messages for me have nothing to do with FreeNAS so I don't know why these are being reported in an error log.

 

[Dudleydogg]

Even now with Version 9 the Problem still persists but I did find this in another Forum: Another reason for the MAC address to change is using bonjour capable devices with a bonjour sleep proxy on the network. When the device goes to sleep, the sleep proxy (which is now responding on behalf of the sleeping machine) sends out a gratuitous ARP so that devices which try to contact the sleeping machine actually hit the sleep proxy (when then wakes the destination).
Sleep proxies are devices like Airport Express/Extreme and Apple TVs (low power, always on).

 

[Ken Almond]

I got this in my VMware environment when I cloned and powered on a 2nd virtual machine with same IP (e.g. 192.168.2.28) and didn't realize it for a bit (15-30 min?).
The 1st machine was running on a FreeNAS 9.2.1.5 NFS mounted datastore.

kernel log messages:
> arp: 192.168.2.28 moved from 00:0c:29:8f:62:67 to 00:50:56:9e:1b:b9 on em0
> arp: 192.168.2.28 moved from 00:50:56:9e:1b:b9 to 00:0c:29:8f:62:67 on em0
> arp: 192.168.2.28 moved from 00:0c:29:8f:62:67 to 00:50:56:9e:1b:b9 on em0
> arp: 192.168.2.28 moved from 00:50:56:9e:1b:b9 to 00:0c:29:8f:62:67 on em0
> arp: 192.168.2.28 moved from 00:0c:29:8f:62:67 to 00:50:56:9e:1b:b9 on em0
> arp: 192.168.2.28 moved from 00:50:56:9e:1b:b9 to 00:50:56:9e:47:3f on em0
> arp: 192.168.2.28 moved from 00:50:56:9e:47:3f to 00:0c:29:8f:62:67 on em0
> arp: 192.168.2.28 moved from 00:0c:29:8f:62:67 to 00:50:56:9e:47:3f on em0
> arp: 192.168.2.28 moved from 00:50:56:9e:47:3f to 00:0c:29:8f:62:67 on em0

-- End of security output --

 

[Darren Myers]

i just started getting these emails on my FreeNAS server, FreeNAS-9.3-STABLE-201506292130

 

[sirkkalap]

Even now with Version 9 the Problem still persists but I did find this in another Forum: Another reason for the MAC address to change is using bonjour capable devices with a bonjour sleep proxy on the network. When the device goes to sleep, the sleep proxy (which is now responding on behalf of the sleeping machine) sends out a gratuitous ARP so that devices which try to contact the sleeping machine actually hit the sleep proxy (when then wakes the destination).
Sleep proxies are devices like Airport Express/Extreme and Apple TVs (low power, always on).

Thank you for the explanation that matches my network setup. I was not aware of this kind of sleep-proxy behaviour. Very nice to know. Well it seem that my MSc degree is getting outdated sooner than I expected, only defence being that Communication Systems and Networks was my minor :)

 

[fireheadman]

I am on v9.10 and getting these messages everyday in my daily security emails... very annoying.

Code:

maxxximus.xxxxxxxxx.com kernel log messages:
> arp: 192.168.1.1x2 moved from 74:da:38:1e:99:67 to c8:60:00:e7:be:f0 on lagg0
> arp: 192.168.1.1x1 moved from c8:60:00:e7:be:f0 to 74:da:38:1e:99:67 on epair2b
> arp: 192.168.1.1x1 moved from 74:da:38:1e:99:67 to c8:60:00:e7:be:f0 on epair2b
> arp: 192.168.1.1x1 moved from c8:60:00:e7:be:f0 to 74:da:38:1e:99:67 on epair2b
> arp: 192.168.1.1x1 moved from 74:da:38:1e:99:67 to c8:60:00:e7:be:f0 on epair2b
> arp: 192.168.1.1x1 moved from c8:60:00:e7:be:f0 to 74:da:38:1e:99:67 on epair2b
> arp: 192.168.1.1x1 moved from 74:da:38:1e:99:67 to c8:60:00:e7:be:f0 on epair2b
> arp: 192.168.1.1x1 moved from 74:da:38:1e:99:67 to c8:60:00:e7:be:f0 on epair2b
> arp: 192.168.1.1x1 moved from c8:60:00:e7:be:f0 to 74:da:38:1e:99:67 on epair2b
> arp: 192.168.1.1x1 moved from 74:da:38:1e:99:67 to c8:60:00:e7:be:f0 on epair2b
> arp: 192.168.1.1x1 moved from c8:60:00:e7:be:f0 to 74:da:38:1e:99:67 on epair2b
> arp: 192.168.1.1x1 moved from 74:da:38:1e:99:67 to c8:60:00:e7:be:f0 on epair2b
> arp: 192.168.1.1x1 moved from c8:60:00:e7:be:f0 to 74:da:38:1e:99:67 on epair2b
> arp: 192.168.1.1x1 moved from 74:da:38:1e:99:67 to c8:60:00:e7:be:f0 on epair2b
> arp: 192.168.1.1x1 moved from c8:60:00:e7:be:f0 to 74:da:38:1e:99:67 on epair2b
> arp: 192.168.1.1x1 moved from 74:da:38:1e:99:67 to c8:60:00:e7:be:f0 on epair2b
> arp: 192.168.1.1x1 moved from 74:da:38:1e:99:67 to c8:60:00:e7:be:f0 on epair2b
> arp: 192.168.1.1x1 moved from c8:60:00:e7:be:f0 to 74:da:38:1e:99:67 on epair2b

I'm sorry for reviving a dead thread, however, I've ran into this issue when there is nothing configured wrong (that I can tell), and I wanted to share how to silence these messages. One of the causes of this could be bridging multiple interfaces. So you may see it with some jails, depending on your configuration.

Try creating a sysctl called net.link.ether.inet.log_arp_movements and set its value to 0. This was helpful for me since it was cluttering the console log.

looking into where this is set at? from the GUI? or CLI?

 

[fireheadman]

I am on v9.10 and getting these messages everyday in my daily security emails... very annoying.

Code:

maxxximus.xxxxxxxxx.com kernel log messages:
> arp: 192.168.1.1x2 moved from 74:da:38:1e:99:67 to c8:60:00:e7:be:f0 on lagg0
> arp: 192.168.1.1x1 moved from c8:60:00:e7:be:f0 to 74:da:38:1e:99:67 on epair2b
> arp: 192.168.1.1x1 moved from 74:da:38:1e:99:67 to c8:60:00:e7:be:f0 on epair2b
> arp: 192.168.1.1x1 moved from c8:60:00:e7:be:f0 to 74:da:38:1e:99:67 on epair2b
> arp: 192.168.1.1x1 moved from 74:da:38:1e:99:67 to c8:60:00:e7:be:f0 on epair2b
> arp: 192.168.1.1x1 moved from c8:60:00:e7:be:f0 to 74:da:38:1e:99:67 on epair2b
> arp: 192.168.1.1x1 moved from 74:da:38:1e:99:67 to c8:60:00:e7:be:f0 on epair2b
> arp: 192.168.1.1x1 moved from 74:da:38:1e:99:67 to c8:60:00:e7:be:f0 on epair2b
> arp: 192.168.1.1x1 moved from c8:60:00:e7:be:f0 to 74:da:38:1e:99:67 on epair2b
> arp: 192.168.1.1x1 moved from 74:da:38:1e:99:67 to c8:60:00:e7:be:f0 on epair2b
> arp: 192.168.1.1x1 moved from c8:60:00:e7:be:f0 to 74:da:38:1e:99:67 on epair2b
> arp: 192.168.1.1x1 moved from 74:da:38:1e:99:67 to c8:60:00:e7:be:f0 on epair2b
> arp: 192.168.1.1x1 moved from c8:60:00:e7:be:f0 to 74:da:38:1e:99:67 on epair2b
> arp: 192.168.1.1x1 moved from 74:da:38:1e:99:67 to c8:60:00:e7:be:f0 on epair2b
> arp: 192.168.1.1x1 moved from c8:60:00:e7:be:f0 to 74:da:38:1e:99:67 on epair2b
> arp: 192.168.1.1x1 moved from 74:da:38:1e:99:67 to c8:60:00:e7:be:f0 on epair2b
> arp: 192.168.1.1x1 moved from 74:da:38:1e:99:67 to c8:60:00:e7:be:f0 on epair2b
> arp: 192.168.1.1x1 moved from c8:60:00:e7:be:f0 to 74:da:38:1e:99:67 on epair2b

looking into where this is set at? from the GUI? or CLI?

Found a source, trying it out before making this permanent
http://wp.edsel.nu/2010/07/23/arp-moved-from-to-on-bge0/

Code:

[root@maxxximus ~ 802]# sysctl net.link.ether.inet.log_arp_wrong_iface
net.link.ether.inet.log_arp_wrong_iface: 1
[root@maxxximus ~ 803]# sysctl net.link.ether.inet.log_arp_movements
net.link.ether.inet.log_arp_movements: 1
[root@maxxximus ~ 804]# sysctl net.link.ether.inet.log_arp_wrong_iface=0
net.link.ether.inet.log_arp_wrong_iface: 1 -> 0
[root@maxxximus ~ 807]#  sysctl net.link.ether.inet.log_arp_movements=0
net.link.ether.inet.log_arp_movements: 1 -> 0
[root@maxxximus ~ 808]#