[ previous ] [ next ] [ threads ]
 
 From:  Chris Buechler <cbuechler at gmail dot com>
 Cc:  m0n0wall at lists dot m0n0 dot ch
 Subject:  Re: [m0n0wall] Logs spammed...
 Date:  Sat, 28 Jan 2006 13:39:59 -0500
On 1/27/06, M.Schloeder (Zeitdienst W.Sorge) <schloeder at zeitdienst dot de> wrote:
> Jan 27 11:54:48 m0n0wall /kernel: arp: 192.168.0.110 moved from
> 00:07:e9:3f:e9:89 to 00:07:e9:3f:e9:88 on rl0
> Jan 27 11:54:49 m0n0wall /kernel: arp: 192.168.0.110 moved from
> 00:07:e9:3f:e9:88 to 00:07:e9:3f:e9:89 on rl0
> Jan 27 11:55:01 m0n0wall /kernel: arp: 192.168.0.110 moved from
> 00:07:e9:3f:e9:89 to 00:07:e9:3f:e9:88 on rl0
> Jan 27 11:55:01 m0n0wall /kernel: arp: 192.168.0.110 moved from
> 00:07:e9:3f:e9:88 to 00:07:e9:3f:e9:89 on rl0
> Jan 27 11:51:31 m0n0wall last message repeated 3 times
>

What's 192.168.0.110?  The MAC address is Intel, and it seems like
some sort of failover or loadbalancing between Intel NIC's (with
subsequent MAC addresses like that, :88, and :89, I would assume it's
two onboard NIC's).

The only time I've seen that, or heard of others seeing it, is when
some router is running some type of failover configuration.  I've seen
badly configured Cisco routers fail over back and forth repeatedly
like that, but that's not the case here since they're Intel MAC's. 
There are other possibilities, and it's definitely something I'd
investigate.  You shouldn't ever see that in heavy volume, it's
telling you about a problem with your network.

-Chris