Mailing List Archive

IP/ARP: IP address x.y.z.t MAC movement detected, changed from (...)
Hi,

After upgrading to 5.6 (CER devices), we keep having the following
messages:

Oct 13 12:46:03:W:IP/ARP: IP address 194.68.129.xxx MAC movement detected, changed from MAC 0022.83d4.1ff0 / port 1/3 to MAC 0022.8354.1ff0 / port 1/3
Oct 13 12:46:02:W:IP/ARP: IP address 194.68.129.xxx MAC movement detected, changed from MAC 0022.8354.1ff0 / port 1/3 to MAC 0022.83d4.1ff0 / port 1/3
Oct 13 12:44:13:W:IP/ARP: IP address 194.68.129.xxx MAC movement detected, changed from MAC 0022.83d4.1ff0 / port 1/3 to MAC 0022.8354.1ff0 / port 1/3
Oct 13 12:44:09:W:IP/ARP: IP address 194.68.129.xxx MAC movement detected, changed from MAC 0022.8354.1ff0 / port 1/3 to MAC 0022.83d4.1ff0 / port 1/3
Oct 13 12:40:14:W:IP/ARP: IP address 194.68.129.yyy MAC movement detected, changed from MAC 009b.0de4.41c0 / port 1/3 to MAC 001b.0de4.41c0 / port 1/3
Oct 13 12:40:14:W:IP/ARP: IP address 194.68.129.yyy MAC movement detected, changed from MAC 001b.0de4.41c0 / port 1/3 to MAC 009b.0de4.41c0 / port 1/3
Oct 13 12:37:40:W:IP/ARP: IP address 194.68.129.yyy MAC movement detected, changed from MAC 009b.0de4.41c0 / port 1/3 to MAC 001b.0de4.41c0 / port 1/3
Oct 13 12:37:40:W:IP/ARP: IP address 194.68.129.yyy MAC movement detected, changed from MAC 001b.0de4.41c0 / port 1/3 to MAC 009b.0de4.41c0 / port 1/3
Oct 13 12:16:50:W:IP/ARP: IP address 194.68.129.yyy MAC movement detected, changed from MAC 009b.0de4.41c0 / port 1/3 to MAC 001b.0de4.41c0 / port 1/3
Oct 13 12:16:50:W:IP/ARP: IP address 194.68.129.yyy MAC movement detected, changed from MAC 001b.0de4.41c0 / port 1/3 to MAC 009b.0de4.41c0 / port 1/3
Oct 13 12:12:02:W:IP/ARP: IP address 194.68.129.yyy MAC movement detected, changed from MAC 009b.0de4.41c0 / port 1/3 to MAC 001b.0de4.41c0 / port 1/3
Oct 13 12:12:02:W:IP/ARP: IP address 194.68.129.yyy MAC movement detected, changed from MAC 001b.0de4.41c0 / port 1/3 to MAC 009b.0de4.41c0 / port 1/3
Oct 13 12:11:44:W:IP/ARP: IP address 194.68.129.yyy MAC movement detected, changed from MAC 009b.0de4.41c0 / port 1/3 to MAC 001b.0de4.41c0 / port 1/3
Oct 13 12:11:44:W:IP/ARP: IP address 194.68.129.yyy MAC movement detected, changed from MAC 001b.0de4.41c0 / port 1/3 to MAC 009b.0de4.41c0 / port 1/3
Oct 13 12:10:16:W:IP/ARP: IP address 80.249.208.zzz MAC movement detected, changed from MAC 0025.900a.0c17 / port 1/38 to MAC 000e.d6b5.7c00 / port 1/38
Oct 13 12:09:33:W:IP/ARP: IP address 80.249.208.zzz MAC movement detected, changed from MAC 000e.d6b5.7c00 / port 1/38 to MAC 0025.900a.0c17 / port 1/38
Oct 13 12:06:18:W:IP/ARP: IP address 194.68.129.yyy MAC movement detected, changed from MAC 009b.0de4.41c0 / port 1/3 to MAC 001b.0de4.41c0 / port 1/3
Oct 13 12:06:18:W:IP/ARP: IP address 194.68.129.yyy MAC movement detected, changed from MAC 001b.0de4.41c0 / port 1/3 to MAC 009b.0de4.41c0 / port 1/3

I am pretty sure that the MACs are not really changing, as it is on IXPs
where strict mac filtering is enabled. This happens on various devices,
from various networks I manage. There is no operational problem, apart
from fulfilling my log buffer

Anyone aware of any kind of bug with that ?

Thanks,

--
Clément Cavadore


_______________________________________________
foundry-nsp mailing list
foundry-nsp@puck.nether.net
http://puck.nether.net/mailman/listinfo/foundry-nsp
Re: IP/ARP: IP address x.y.z.t MAC movement detected, changed from (...) [ In reply to ]
Seems that I am not alone:
http://community.brocade.com/t5/Ethernet-Switches-Routers/Getting-log-message-MAC-movement-detected-after-code-upgrade-to/td-p/66490

Regards,

--
Clément Cavadore

On Mon, 2014-10-13 at 13:34 +0200, Clement Cavadore wrote:
> Hi,
>
> After upgrading to 5.6 (CER devices), we keep having the following
> messages:
>
> Oct 13 12:46:03:W:IP/ARP: IP address 194.68.129.xxx MAC movement detected, changed from MAC 0022.83d4.1ff0 / port 1/3 to MAC 0022.8354.1ff0 / port 1/3
> Oct 13 12:46:02:W:IP/ARP: IP address 194.68.129.xxx MAC movement detected, changed from MAC 0022.8354.1ff0 / port 1/3 to MAC 0022.83d4.1ff0 / port 1/3
> Oct 13 12:44:13:W:IP/ARP: IP address 194.68.129.xxx MAC movement detected, changed from MAC 0022.83d4.1ff0 / port 1/3 to MAC 0022.8354.1ff0 / port 1/3
> Oct 13 12:44:09:W:IP/ARP: IP address 194.68.129.xxx MAC movement detected, changed from MAC 0022.8354.1ff0 / port 1/3 to MAC 0022.83d4.1ff0 / port 1/3
> Oct 13 12:40:14:W:IP/ARP: IP address 194.68.129.yyy MAC movement detected, changed from MAC 009b.0de4.41c0 / port 1/3 to MAC 001b.0de4.41c0 / port 1/3
> Oct 13 12:40:14:W:IP/ARP: IP address 194.68.129.yyy MAC movement detected, changed from MAC 001b.0de4.41c0 / port 1/3 to MAC 009b.0de4.41c0 / port 1/3
> Oct 13 12:37:40:W:IP/ARP: IP address 194.68.129.yyy MAC movement detected, changed from MAC 009b.0de4.41c0 / port 1/3 to MAC 001b.0de4.41c0 / port 1/3
> Oct 13 12:37:40:W:IP/ARP: IP address 194.68.129.yyy MAC movement detected, changed from MAC 001b.0de4.41c0 / port 1/3 to MAC 009b.0de4.41c0 / port 1/3
> Oct 13 12:16:50:W:IP/ARP: IP address 194.68.129.yyy MAC movement detected, changed from MAC 009b.0de4.41c0 / port 1/3 to MAC 001b.0de4.41c0 / port 1/3
> Oct 13 12:16:50:W:IP/ARP: IP address 194.68.129.yyy MAC movement detected, changed from MAC 001b.0de4.41c0 / port 1/3 to MAC 009b.0de4.41c0 / port 1/3
> Oct 13 12:12:02:W:IP/ARP: IP address 194.68.129.yyy MAC movement detected, changed from MAC 009b.0de4.41c0 / port 1/3 to MAC 001b.0de4.41c0 / port 1/3
> Oct 13 12:12:02:W:IP/ARP: IP address 194.68.129.yyy MAC movement detected, changed from MAC 001b.0de4.41c0 / port 1/3 to MAC 009b.0de4.41c0 / port 1/3
> Oct 13 12:11:44:W:IP/ARP: IP address 194.68.129.yyy MAC movement detected, changed from MAC 009b.0de4.41c0 / port 1/3 to MAC 001b.0de4.41c0 / port 1/3
> Oct 13 12:11:44:W:IP/ARP: IP address 194.68.129.yyy MAC movement detected, changed from MAC 001b.0de4.41c0 / port 1/3 to MAC 009b.0de4.41c0 / port 1/3
> Oct 13 12:10:16:W:IP/ARP: IP address 80.249.208.zzz MAC movement detected, changed from MAC 0025.900a.0c17 / port 1/38 to MAC 000e.d6b5.7c00 / port 1/38
> Oct 13 12:09:33:W:IP/ARP: IP address 80.249.208.zzz MAC movement detected, changed from MAC 000e.d6b5.7c00 / port 1/38 to MAC 0025.900a.0c17 / port 1/38
> Oct 13 12:06:18:W:IP/ARP: IP address 194.68.129.yyy MAC movement detected, changed from MAC 009b.0de4.41c0 / port 1/3 to MAC 001b.0de4.41c0 / port 1/3
> Oct 13 12:06:18:W:IP/ARP: IP address 194.68.129.yyy MAC movement detected, changed from MAC 001b.0de4.41c0 / port 1/3 to MAC 009b.0de4.41c0 / port 1/3
>
> I am pretty sure that the MACs are not really changing, as it is on IXPs
> where strict mac filtering is enabled. This happens on various devices,
> from various networks I manage. There is no operational problem, apart
> from fulfilling my log buffer
>
> Anyone aware of any kind of bug with that ?
>
> Thanks,
>


_______________________________________________
foundry-nsp mailing list
foundry-nsp@puck.nether.net
http://puck.nether.net/mailman/listinfo/foundry-nsp
Re: IP/ARP: IP address x.y.z.t MAC movement detected, changed from (...) [ In reply to ]
Hello Clement, All,

Let's add this one to this list of NI oddities [?]

Best regards.



2014-10-13 13:36 GMT+02:00 Clement Cavadore <clement@cavadore.net>:

> Seems that I am not alone:
>
> http://community.brocade.com/t5/Ethernet-Switches-Routers/Getting-log-message-MAC-movement-detected-after-code-upgrade-to/td-p/66490
>
> Regards,
>
> --
> Clément Cavadore
>
> On Mon, 2014-10-13 at 13:34 +0200, Clement Cavadore wrote:
> > Hi,
> >
> > After upgrading to 5.6 (CER devices), we keep having the following
> > messages:
> >
> > Oct 13 12:46:03:W:IP/ARP: IP address 194.68.129.xxx MAC movement
> detected, changed from MAC 0022.83d4.1ff0 / port 1/3 to MAC 0022.8354.1ff0
> / port 1/3
> > Oct 13 12:46:02:W:IP/ARP: IP address 194.68.129.xxx MAC movement
> detected, changed from MAC 0022.8354.1ff0 / port 1/3 to MAC 0022.83d4.1ff0
> / port 1/3
> > Oct 13 12:44:13:W:IP/ARP: IP address 194.68.129.xxx MAC movement
> detected, changed from MAC 0022.83d4.1ff0 / port 1/3 to MAC 0022.8354.1ff0
> / port 1/3
> > Oct 13 12:44:09:W:IP/ARP: IP address 194.68.129.xxx MAC movement
> detected, changed from MAC 0022.8354.1ff0 / port 1/3 to MAC 0022.83d4.1ff0
> / port 1/3
> > Oct 13 12:40:14:W:IP/ARP: IP address 194.68.129.yyy MAC movement
> detected, changed from MAC 009b.0de4.41c0 / port 1/3 to MAC 001b.0de4.41c0
> / port 1/3
> > Oct 13 12:40:14:W:IP/ARP: IP address 194.68.129.yyy MAC movement
> detected, changed from MAC 001b.0de4.41c0 / port 1/3 to MAC 009b.0de4.41c0
> / port 1/3
> > Oct 13 12:37:40:W:IP/ARP: IP address 194.68.129.yyy MAC movement
> detected, changed from MAC 009b.0de4.41c0 / port 1/3 to MAC 001b.0de4.41c0
> / port 1/3
> > Oct 13 12:37:40:W:IP/ARP: IP address 194.68.129.yyy MAC movement
> detected, changed from MAC 001b.0de4.41c0 / port 1/3 to MAC 009b.0de4.41c0
> / port 1/3
> > Oct 13 12:16:50:W:IP/ARP: IP address 194.68.129.yyy MAC movement
> detected, changed from MAC 009b.0de4.41c0 / port 1/3 to MAC 001b.0de4.41c0
> / port 1/3
> > Oct 13 12:16:50:W:IP/ARP: IP address 194.68.129.yyy MAC movement
> detected, changed from MAC 001b.0de4.41c0 / port 1/3 to MAC 009b.0de4.41c0
> / port 1/3
> > Oct 13 12:12:02:W:IP/ARP: IP address 194.68.129.yyy MAC movement
> detected, changed from MAC 009b.0de4.41c0 / port 1/3 to MAC 001b.0de4.41c0
> / port 1/3
> > Oct 13 12:12:02:W:IP/ARP: IP address 194.68.129.yyy MAC movement
> detected, changed from MAC 001b.0de4.41c0 / port 1/3 to MAC 009b.0de4.41c0
> / port 1/3
> > Oct 13 12:11:44:W:IP/ARP: IP address 194.68.129.yyy MAC movement
> detected, changed from MAC 009b.0de4.41c0 / port 1/3 to MAC 001b.0de4.41c0
> / port 1/3
> > Oct 13 12:11:44:W:IP/ARP: IP address 194.68.129.yyy MAC movement
> detected, changed from MAC 001b.0de4.41c0 / port 1/3 to MAC 009b.0de4.41c0
> / port 1/3
> > Oct 13 12:10:16:W:IP/ARP: IP address 80.249.208.zzz MAC movement
> detected, changed from MAC 0025.900a.0c17 / port 1/38 to MAC 000e.d6b5.7c00
> / port 1/38
> > Oct 13 12:09:33:W:IP/ARP: IP address 80.249.208.zzz MAC movement
> detected, changed from MAC 000e.d6b5.7c00 / port 1/38 to MAC 0025.900a.0c17
> / port 1/38
> > Oct 13 12:06:18:W:IP/ARP: IP address 194.68.129.yyy MAC movement
> detected, changed from MAC 009b.0de4.41c0 / port 1/3 to MAC 001b.0de4.41c0
> / port 1/3
> > Oct 13 12:06:18:W:IP/ARP: IP address 194.68.129.yyy MAC movement
> detected, changed from MAC 001b.0de4.41c0 / port 1/3 to MAC 009b.0de4.41c0
> / port 1/3
> >
> > I am pretty sure that the MACs are not really changing, as it is on IXPs
> > where strict mac filtering is enabled. This happens on various devices,
> > from various networks I manage. There is no operational problem, apart
> > from fulfilling my log buffer
> >
> > Anyone aware of any kind of bug with that ?
> >
> > Thanks,
> >
>
>
> _______________________________________________
> foundry-nsp mailing list
> foundry-nsp@puck.nether.net
> http://puck.nether.net/mailman/listinfo/foundry-nsp
>



--
Youssef BENGELLOUN-ZAHR
Re: IP/ARP: IP address x.y.z.t MAC movement detected, changed from (...) [ In reply to ]
I have been getting those messages, but I had just assumed they were
correct. Is it possible that the remote device is running VRRP/HSRP?

Maybe it is time for me to start packet sniffing on this one.

--
Eldon Koyle
--
One of the lessons of history is that nothing is often a good thing to
do and always a clever thing to say.
-- Will Durant

On Oct 13 13:36+0200, Clement Cavadore wrote:
> Seems that I am not alone:
> http://community.brocade.com/t5/Ethernet-Switches-Routers/Getting-log-message-MAC-movement-detected-after-code-upgrade-to/td-p/66490
>
> Regards,
>
> --
> Clément Cavadore
>
> On Mon, 2014-10-13 at 13:34 +0200, Clement Cavadore wrote:
> > Hi,
> >
> > After upgrading to 5.6 (CER devices), we keep having the following
> > messages:
> >
> > Oct 13 12:46:03:W:IP/ARP: IP address 194.68.129.xxx MAC movement detected, changed from MAC 0022.83d4.1ff0 / port 1/3 to MAC 0022.8354.1ff0 / port 1/3
> > Oct 13 12:46:02:W:IP/ARP: IP address 194.68.129.xxx MAC movement detected, changed from MAC 0022.8354.1ff0 / port 1/3 to MAC 0022.83d4.1ff0 / port 1/3
> > Oct 13 12:44:13:W:IP/ARP: IP address 194.68.129.xxx MAC movement detected, changed from MAC 0022.83d4.1ff0 / port 1/3 to MAC 0022.8354.1ff0 / port 1/3
> > Oct 13 12:44:09:W:IP/ARP: IP address 194.68.129.xxx MAC movement detected, changed from MAC 0022.8354.1ff0 / port 1/3 to MAC 0022.83d4.1ff0 / port 1/3
> > Oct 13 12:40:14:W:IP/ARP: IP address 194.68.129.yyy MAC movement detected, changed from MAC 009b.0de4.41c0 / port 1/3 to MAC 001b.0de4.41c0 / port 1/3
> > Oct 13 12:40:14:W:IP/ARP: IP address 194.68.129.yyy MAC movement detected, changed from MAC 001b.0de4.41c0 / port 1/3 to MAC 009b.0de4.41c0 / port 1/3
> > Oct 13 12:37:40:W:IP/ARP: IP address 194.68.129.yyy MAC movement detected, changed from MAC 009b.0de4.41c0 / port 1/3 to MAC 001b.0de4.41c0 / port 1/3
> > Oct 13 12:37:40:W:IP/ARP: IP address 194.68.129.yyy MAC movement detected, changed from MAC 001b.0de4.41c0 / port 1/3 to MAC 009b.0de4.41c0 / port 1/3
> > Oct 13 12:16:50:W:IP/ARP: IP address 194.68.129.yyy MAC movement detected, changed from MAC 009b.0de4.41c0 / port 1/3 to MAC 001b.0de4.41c0 / port 1/3
> > Oct 13 12:16:50:W:IP/ARP: IP address 194.68.129.yyy MAC movement detected, changed from MAC 001b.0de4.41c0 / port 1/3 to MAC 009b.0de4.41c0 / port 1/3
> > Oct 13 12:12:02:W:IP/ARP: IP address 194.68.129.yyy MAC movement detected, changed from MAC 009b.0de4.41c0 / port 1/3 to MAC 001b.0de4.41c0 / port 1/3
> > Oct 13 12:12:02:W:IP/ARP: IP address 194.68.129.yyy MAC movement detected, changed from MAC 001b.0de4.41c0 / port 1/3 to MAC 009b.0de4.41c0 / port 1/3
> > Oct 13 12:11:44:W:IP/ARP: IP address 194.68.129.yyy MAC movement detected, changed from MAC 009b.0de4.41c0 / port 1/3 to MAC 001b.0de4.41c0 / port 1/3
> > Oct 13 12:11:44:W:IP/ARP: IP address 194.68.129.yyy MAC movement detected, changed from MAC 001b.0de4.41c0 / port 1/3 to MAC 009b.0de4.41c0 / port 1/3
> > Oct 13 12:10:16:W:IP/ARP: IP address 80.249.208.zzz MAC movement detected, changed from MAC 0025.900a.0c17 / port 1/38 to MAC 000e.d6b5.7c00 / port 1/38
> > Oct 13 12:09:33:W:IP/ARP: IP address 80.249.208.zzz MAC movement detected, changed from MAC 000e.d6b5.7c00 / port 1/38 to MAC 0025.900a.0c17 / port 1/38
> > Oct 13 12:06:18:W:IP/ARP: IP address 194.68.129.yyy MAC movement detected, changed from MAC 009b.0de4.41c0 / port 1/3 to MAC 001b.0de4.41c0 / port 1/3
> > Oct 13 12:06:18:W:IP/ARP: IP address 194.68.129.yyy MAC movement detected, changed from MAC 001b.0de4.41c0 / port 1/3 to MAC 009b.0de4.41c0 / port 1/3
> >
> > I am pretty sure that the MACs are not really changing, as it is on IXPs
> > where strict mac filtering is enabled. This happens on various devices,
> > from various networks I manage. There is no operational problem, apart
> > from fulfilling my log buffer
> >
> > Anyone aware of any kind of bug with that ?
> >
> > Thanks,
> >
>
>
> _______________________________________________
> foundry-nsp mailing list
> foundry-nsp@puck.nether.net
> http://puck.nether.net/mailman/listinfo/foundry-nsp
_______________________________________________
foundry-nsp mailing list
foundry-nsp@puck.nether.net
http://puck.nether.net/mailman/listinfo/foundry-nsp
Re: IP/ARP: IP address x.y.z.t MAC movement detected, changed from (...) [ In reply to ]
I don't think so, since it is on some IXP peering LANs, and those IXP
apply strict filtering policies on their customer ports :-)

Btw, I have noticed some strange stuffs, for example:


SYSLOG: <156>Oct 13 18:22:05 rt2-th2 IP/ARP: IP address 194.68.129.xxx MAC movement detected, changed from MAC 001b.0de4.41c0 / port 1/3 to MAC 009b.0de4.41c0 / port 1/3
SYSLOG: <156>Oct 13 18:22:05 rt2-th2 IP/ARP: IP address 194.68.129.xxx MAC movement detected, changed from MAC 009b.0de4.41c0 / port 1/3 to MAC 001b.0de4.41c0 / port 1/3

001b.0de4.41c0 is the hw address resovled with ARP of two IP on two different IXP:

telnet@xxxx#sh arp | i 001b.0de4.41c0
689 80.249.208.yyy 001b.0de4.41c0 Dynamic 0 1/38
904 194.68.129.xxx 001b.0de4.41c0 Dynamic 0 1/3

009b.0de4.41c0 does not appear anywhere on my MAC address table or ARP
table.

On Mon, 2014-10-13 at 10:20 -0600, Eldon Koyle wrote:
> I have been getting those messages, but I had just assumed they were
> correct. Is it possible that the remote device is running VRRP/HSRP?
>
> Maybe it is time for me to start packet sniffing on this one.
>
> --
> Eldon Koyle


_______________________________________________
foundry-nsp mailing list
foundry-nsp@puck.nether.net
http://puck.nether.net/mailman/listinfo/foundry-nsp
Re: IP/ARP: IP address x.y.z.t MAC movement detected, changed from (...) [ In reply to ]
It is quite odd that those two MAC addresses differ by one bit. Could
this be caused by a bad chip somewhere?

I do see both MAC addresses on my network for all of the messages I have
checked so far.

--
Eldon Koyle
--
America is the country where you buy a lifetime supply of aspirin for one
dollar, and use it up in two weeks.

On Oct 13 18:26+0200, Clement Cavadore wrote:
> I don't think so, since it is on some IXP peering LANs, and those IXP
> apply strict filtering policies on their customer ports :-)
>
> Btw, I have noticed some strange stuffs, for example:
>
>
> SYSLOG: <156>Oct 13 18:22:05 rt2-th2 IP/ARP: IP address 194.68.129.xxx MAC movement detected, changed from MAC 001b.0de4.41c0 / port 1/3 to MAC 009b.0de4.41c0 / port 1/3
> SYSLOG: <156>Oct 13 18:22:05 rt2-th2 IP/ARP: IP address 194.68.129.xxx MAC movement detected, changed from MAC 009b.0de4.41c0 / port 1/3 to MAC 001b.0de4.41c0 / port 1/3
>
> 001b.0de4.41c0 is the hw address resovled with ARP of two IP on two different IXP:
>
> telnet@xxxx#sh arp | i 001b.0de4.41c0
> 689 80.249.208.yyy 001b.0de4.41c0 Dynamic 0 1/38
> 904 194.68.129.xxx 001b.0de4.41c0 Dynamic 0 1/3
>
> 009b.0de4.41c0 does not appear anywhere on my MAC address table or ARP
> table.
>
> On Mon, 2014-10-13 at 10:20 -0600, Eldon Koyle wrote:
> > I have been getting those messages, but I had just assumed they were
> > correct. Is it possible that the remote device is running VRRP/HSRP?
> >
> > Maybe it is time for me to start packet sniffing on this one.
> >
> > --
> > Eldon Koyle
>
>
>
_______________________________________________
foundry-nsp mailing list
foundry-nsp@puck.nether.net
http://puck.nether.net/mailman/listinfo/foundry-nsp
Re: IP/ARP: IP address x.y.z.t MAC movement detected, changed from (...) [ In reply to ]
On Mon, 2014-10-13 at 10:47 -0600, Eldon Koyle wrote:
> It is quite odd that those two MAC addresses differ by one bit. Could
> this be caused by a bad chip somewhere?

I am unsure about this, since I have seen that after upgrading the
ironware to 5.6x. The same has appeared on one of my customer's network
too, after an upgrade. That's why I asked here :-)

> I do see both MAC addresses on my network for all of the messages I have
> checked so far.

So maybe yours are legit :-)
Mine are not, for sure !

--
Clément Cavadore

_______________________________________________
foundry-nsp mailing list
foundry-nsp@puck.nether.net
http://puck.nether.net/mailman/listinfo/foundry-nsp
Re: IP/ARP: IP address x.y.z.t MAC movement detected, changed from (...) [ In reply to ]
If you cannot resolve the underlying cause and these are filling up your logs, you can use:

no logging buffered warnings

However, keep in mind that does knock out some other messages that you may not want to sacrifice logging. In one of our instances, the tradeoff was worth it to implement the command.

Regards,
Mike


On Oct 13, 2014, at 4:34 AM, Clement Cavadore <clement@cavadore.net> wrote:

> Hi,
>
> After upgrading to 5.6 (CER devices), we keep having the following
> messages:
>
> Oct 13 12:46:03:W:IP/ARP: IP address 194.68.129.xxx MAC movement detected, changed from MAC 0022.83d4.1ff0 / port 1/3 to MAC 0022.8354.1ff0 / port 1/3
> Oct 13 12:46:02:W:IP/ARP: IP address 194.68.129.xxx MAC movement detected, changed from MAC 0022.8354.1ff0 / port 1/3 to MAC 0022.83d4.1ff0 / port 1/3
> Oct 13 12:44:13:W:IP/ARP: IP address 194.68.129.xxx MAC movement detected, changed from MAC 0022.83d4.1ff0 / port 1/3 to MAC 0022.8354.1ff0 / port 1/3
> Oct 13 12:44:09:W:IP/ARP: IP address 194.68.129.xxx MAC movement detected, changed from MAC 0022.8354.1ff0 / port 1/3 to MAC 0022.83d4.1ff0 / port 1/3
> Oct 13 12:40:14:W:IP/ARP: IP address 194.68.129.yyy MAC movement detected, changed from MAC 009b.0de4.41c0 / port 1/3 to MAC 001b.0de4.41c0 / port 1/3
> Oct 13 12:40:14:W:IP/ARP: IP address 194.68.129.yyy MAC movement detected, changed from MAC 001b.0de4.41c0 / port 1/3 to MAC 009b.0de4.41c0 / port 1/3
> Oct 13 12:37:40:W:IP/ARP: IP address 194.68.129.yyy MAC movement detected, changed from MAC 009b.0de4.41c0 / port 1/3 to MAC 001b.0de4.41c0 / port 1/3
> Oct 13 12:37:40:W:IP/ARP: IP address 194.68.129.yyy MAC movement detected, changed from MAC 001b.0de4.41c0 / port 1/3 to MAC 009b.0de4.41c0 / port 1/3
> Oct 13 12:16:50:W:IP/ARP: IP address 194.68.129.yyy MAC movement detected, changed from MAC 009b.0de4.41c0 / port 1/3 to MAC 001b.0de4.41c0 / port 1/3
> Oct 13 12:16:50:W:IP/ARP: IP address 194.68.129.yyy MAC movement detected, changed from MAC 001b.0de4.41c0 / port 1/3 to MAC 009b.0de4.41c0 / port 1/3
> Oct 13 12:12:02:W:IP/ARP: IP address 194.68.129.yyy MAC movement detected, changed from MAC 009b.0de4.41c0 / port 1/3 to MAC 001b.0de4.41c0 / port 1/3
> Oct 13 12:12:02:W:IP/ARP: IP address 194.68.129.yyy MAC movement detected, changed from MAC 001b.0de4.41c0 / port 1/3 to MAC 009b.0de4.41c0 / port 1/3
> Oct 13 12:11:44:W:IP/ARP: IP address 194.68.129.yyy MAC movement detected, changed from MAC 009b.0de4.41c0 / port 1/3 to MAC 001b.0de4.41c0 / port 1/3
> Oct 13 12:11:44:W:IP/ARP: IP address 194.68.129.yyy MAC movement detected, changed from MAC 001b.0de4.41c0 / port 1/3 to MAC 009b.0de4.41c0 / port 1/3
> Oct 13 12:10:16:W:IP/ARP: IP address 80.249.208.zzz MAC movement detected, changed from MAC 0025.900a.0c17 / port 1/38 to MAC 000e.d6b5.7c00 / port 1/38
> Oct 13 12:09:33:W:IP/ARP: IP address 80.249.208.zzz MAC movement detected, changed from MAC 000e.d6b5.7c00 / port 1/38 to MAC 0025.900a.0c17 / port 1/38
> Oct 13 12:06:18:W:IP/ARP: IP address 194.68.129.yyy MAC movement detected, changed from MAC 009b.0de4.41c0 / port 1/3 to MAC 001b.0de4.41c0 / port 1/3
> Oct 13 12:06:18:W:IP/ARP: IP address 194.68.129.yyy MAC movement detected, changed from MAC 001b.0de4.41c0 / port 1/3 to MAC 009b.0de4.41c0 / port 1/3
>
> I am pretty sure that the MACs are not really changing, as it is on IXPs
> where strict mac filtering is enabled. This happens on various devices,
> from various networks I manage. There is no operational problem, apart
> from fulfilling my log buffer
>
> Anyone aware of any kind of bug with that ?
>
> Thanks,
>
> --
> Clément Cavadore
>
>
> _______________________________________________
> foundry-nsp mailing list
> foundry-nsp@puck.nether.net
> http://puck.nether.net/mailman/listinfo/foundry-nsp

*----------- H U R R I C A N E - E L E C T R I C ---------->>
| Mike Tindle | Senior Network Engineer | mtindle@he.net
| ASN 6939 | http://www.he.net | 510-580-4126
*--------------------------------------------------->>
Re: IP/ARP: IP address x.y.z.t MAC movement detected, changed from (...) [ In reply to ]
Hi Mike,

Sure, but in an IXP context (especially AMS-IX :)), that would also
remove the warning limit for the No. of prefix received from BGP
peers... So I think I'd prefer having those, but still seeing the
warning messages :)

Btw, I hope that it's a known bug !

Regards,

--
Clément

On Mon, 2014-10-13 at 10:12 -0700, Mike Tindle wrote:
> If you cannot resolve the underlying cause and these are filling up
> your logs, you can use:
>
>
> no logging buffered warnings
>
>
> However, keep in mind that does knock out some other messages that you
> may not want to sacrifice logging. In one of our instances, the
> tradeoff was worth it to implement the command.
>
>
> Regards,
> Mike
>
>
>
> On Oct 13, 2014, at 4:34 AM, Clement Cavadore <clement@cavadore.net>
> wrote:
>
> > Hi,
> >
> > After upgrading to 5.6 (CER devices), we keep having the following
> > messages:
> >
> > Oct 13 12:46:03:W:IP/ARP: IP address 194.68.129.xxx MAC movement
> > detected, changed from MAC 0022.83d4.1ff0 / port 1/3 to MAC
> > 0022.8354.1ff0 / port 1/3
> > Oct 13 12:46:02:W:IP/ARP: IP address 194.68.129.xxx MAC movement
> > detected, changed from MAC 0022.8354.1ff0 / port 1/3 to MAC
> > 0022.83d4.1ff0 / port 1/3
> > Oct 13 12:44:13:W:IP/ARP: IP address 194.68.129.xxx MAC movement
> > detected, changed from MAC 0022.83d4.1ff0 / port 1/3 to MAC
> > 0022.8354.1ff0 / port 1/3
> > Oct 13 12:44:09:W:IP/ARP: IP address 194.68.129.xxx MAC movement
> > detected, changed from MAC 0022.8354.1ff0 / port 1/3 to MAC
> > 0022.83d4.1ff0 / port 1/3
> > Oct 13 12:40:14:W:IP/ARP: IP address 194.68.129.yyy MAC movement
> > detected, changed from MAC 009b.0de4.41c0 / port 1/3 to MAC
> > 001b.0de4.41c0 / port 1/3
> > Oct 13 12:40:14:W:IP/ARP: IP address 194.68.129.yyy MAC movement
> > detected, changed from MAC 001b.0de4.41c0 / port 1/3 to MAC
> > 009b.0de4.41c0 / port 1/3
> > Oct 13 12:37:40:W:IP/ARP: IP address 194.68.129.yyy MAC movement
> > detected, changed from MAC 009b.0de4.41c0 / port 1/3 to MAC
> > 001b.0de4.41c0 / port 1/3
> > Oct 13 12:37:40:W:IP/ARP: IP address 194.68.129.yyy MAC movement
> > detected, changed from MAC 001b.0de4.41c0 / port 1/3 to MAC
> > 009b.0de4.41c0 / port 1/3
> > Oct 13 12:16:50:W:IP/ARP: IP address 194.68.129.yyy MAC movement
> > detected, changed from MAC 009b.0de4.41c0 / port 1/3 to MAC
> > 001b.0de4.41c0 / port 1/3
> > Oct 13 12:16:50:W:IP/ARP: IP address 194.68.129.yyy MAC movement
> > detected, changed from MAC 001b.0de4.41c0 / port 1/3 to MAC
> > 009b.0de4.41c0 / port 1/3
> > Oct 13 12:12:02:W:IP/ARP: IP address 194.68.129.yyy MAC movement
> > detected, changed from MAC 009b.0de4.41c0 / port 1/3 to MAC
> > 001b.0de4.41c0 / port 1/3
> > Oct 13 12:12:02:W:IP/ARP: IP address 194.68.129.yyy MAC movement
> > detected, changed from MAC 001b.0de4.41c0 / port 1/3 to MAC
> > 009b.0de4.41c0 / port 1/3
> > Oct 13 12:11:44:W:IP/ARP: IP address 194.68.129.yyy MAC movement
> > detected, changed from MAC 009b.0de4.41c0 / port 1/3 to MAC
> > 001b.0de4.41c0 / port 1/3
> > Oct 13 12:11:44:W:IP/ARP: IP address 194.68.129.yyy MAC movement
> > detected, changed from MAC 001b.0de4.41c0 / port 1/3 to MAC
> > 009b.0de4.41c0 / port 1/3
> > Oct 13 12:10:16:W:IP/ARP: IP address 80.249.208.zzz MAC movement
> > detected, changed from MAC 0025.900a.0c17 / port 1/38 to MAC
> > 000e.d6b5.7c00 / port 1/38
> > Oct 13 12:09:33:W:IP/ARP: IP address 80.249.208.zzz MAC movement
> > detected, changed from MAC 000e.d6b5.7c00 / port 1/38 to MAC
> > 0025.900a.0c17 / port 1/38
> > Oct 13 12:06:18:W:IP/ARP: IP address 194.68.129.yyy MAC movement
> > detected, changed from MAC 009b.0de4.41c0 / port 1/3 to MAC
> > 001b.0de4.41c0 / port 1/3
> > Oct 13 12:06:18:W:IP/ARP: IP address 194.68.129.yyy MAC movement
> > detected, changed from MAC 001b.0de4.41c0 / port 1/3 to MAC
> > 009b.0de4.41c0 / port 1/3
> >
> > I am pretty sure that the MACs are not really changing, as it is on
> > IXPs
> > where strict mac filtering is enabled. This happens on various
> > devices,
> > from various networks I manage. There is no operational problem,
> > apart
> > from fulfilling my log buffer
> >
> > Anyone aware of any kind of bug with that ?
> >
> > Thanks,
> >
> > --
> > Clément Cavadore
> >
> >
> > _______________________________________________
> > foundry-nsp mailing list
> > foundry-nsp@puck.nether.net
> > http://puck.nether.net/mailman/listinfo/foundry-nsp
>
> *----------- H U R R I C A N E - E L E C T R I C ---------->>
> | Mike Tindle | Senior Network Engineer | mtindle@he.net
> | ASN 6939 | http://www.he.net | 510-580-4126
> *--------------------------------------------------->>
>


_______________________________________________
foundry-nsp mailing list
foundry-nsp@puck.nether.net
http://puck.nether.net/mailman/listinfo/foundry-nsp
Re: IP/ARP: IP address x.y.z.t MAC movement detected, changed from (...) [ In reply to ]
Please open a ticket so that it becomes known, and report back the Defect number to us. =)

Frank

-----Original Message-----
From: foundry-nsp [mailto:foundry-nsp-bounces@puck.nether.net] On Behalf Of Clement Cavadore
Sent: Monday, October 13, 2014 12:19 PM
To: Mike Tindle
Cc: foundry-nsp@puck.nether.net
Subject: Re: [f-nsp] IP/ARP: IP address x.y.z.t MAC movement detected, changed from (...)

Hi Mike,

Sure, but in an IXP context (especially AMS-IX :)), that would also
remove the warning limit for the No. of prefix received from BGP
peers... So I think I'd prefer having those, but still seeing the
warning messages :)

Btw, I hope that it's a known bug !

Regards,

--
Clément

On Mon, 2014-10-13 at 10:12 -0700, Mike Tindle wrote:
> If you cannot resolve the underlying cause and these are filling up
> your logs, you can use:
>
>
> no logging buffered warnings
>
>
> However, keep in mind that does knock out some other messages that you
> may not want to sacrifice logging. In one of our instances, the
> tradeoff was worth it to implement the command.
>
>
> Regards,
> Mike
>
>
>
> On Oct 13, 2014, at 4:34 AM, Clement Cavadore <clement@cavadore.net>
> wrote:
>
> > Hi,
> >
> > After upgrading to 5.6 (CER devices), we keep having the following
> > messages:
> >
> > Oct 13 12:46:03:W:IP/ARP: IP address 194.68.129.xxx MAC movement
> > detected, changed from MAC 0022.83d4.1ff0 / port 1/3 to MAC
> > 0022.8354.1ff0 / port 1/3
> > Oct 13 12:46:02:W:IP/ARP: IP address 194.68.129.xxx MAC movement
> > detected, changed from MAC 0022.8354.1ff0 / port 1/3 to MAC
> > 0022.83d4.1ff0 / port 1/3
> > Oct 13 12:44:13:W:IP/ARP: IP address 194.68.129.xxx MAC movement
> > detected, changed from MAC 0022.83d4.1ff0 / port 1/3 to MAC
> > 0022.8354.1ff0 / port 1/3
> > Oct 13 12:44:09:W:IP/ARP: IP address 194.68.129.xxx MAC movement
> > detected, changed from MAC 0022.8354.1ff0 / port 1/3 to MAC
> > 0022.83d4.1ff0 / port 1/3
> > Oct 13 12:40:14:W:IP/ARP: IP address 194.68.129.yyy MAC movement
> > detected, changed from MAC 009b.0de4.41c0 / port 1/3 to MAC
> > 001b.0de4.41c0 / port 1/3
> > Oct 13 12:40:14:W:IP/ARP: IP address 194.68.129.yyy MAC movement
> > detected, changed from MAC 001b.0de4.41c0 / port 1/3 to MAC
> > 009b.0de4.41c0 / port 1/3
> > Oct 13 12:37:40:W:IP/ARP: IP address 194.68.129.yyy MAC movement
> > detected, changed from MAC 009b.0de4.41c0 / port 1/3 to MAC
> > 001b.0de4.41c0 / port 1/3
> > Oct 13 12:37:40:W:IP/ARP: IP address 194.68.129.yyy MAC movement
> > detected, changed from MAC 001b.0de4.41c0 / port 1/3 to MAC
> > 009b.0de4.41c0 / port 1/3
> > Oct 13 12:16:50:W:IP/ARP: IP address 194.68.129.yyy MAC movement
> > detected, changed from MAC 009b.0de4.41c0 / port 1/3 to MAC
> > 001b.0de4.41c0 / port 1/3
> > Oct 13 12:16:50:W:IP/ARP: IP address 194.68.129.yyy MAC movement
> > detected, changed from MAC 001b.0de4.41c0 / port 1/3 to MAC
> > 009b.0de4.41c0 / port 1/3
> > Oct 13 12:12:02:W:IP/ARP: IP address 194.68.129.yyy MAC movement
> > detected, changed from MAC 009b.0de4.41c0 / port 1/3 to MAC
> > 001b.0de4.41c0 / port 1/3
> > Oct 13 12:12:02:W:IP/ARP: IP address 194.68.129.yyy MAC movement
> > detected, changed from MAC 001b.0de4.41c0 / port 1/3 to MAC
> > 009b.0de4.41c0 / port 1/3
> > Oct 13 12:11:44:W:IP/ARP: IP address 194.68.129.yyy MAC movement
> > detected, changed from MAC 009b.0de4.41c0 / port 1/3 to MAC
> > 001b.0de4.41c0 / port 1/3
> > Oct 13 12:11:44:W:IP/ARP: IP address 194.68.129.yyy MAC movement
> > detected, changed from MAC 001b.0de4.41c0 / port 1/3 to MAC
> > 009b.0de4.41c0 / port 1/3
> > Oct 13 12:10:16:W:IP/ARP: IP address 80.249.208.zzz MAC movement
> > detected, changed from MAC 0025.900a.0c17 / port 1/38 to MAC
> > 000e.d6b5.7c00 / port 1/38
> > Oct 13 12:09:33:W:IP/ARP: IP address 80.249.208.zzz MAC movement
> > detected, changed from MAC 000e.d6b5.7c00 / port 1/38 to MAC
> > 0025.900a.0c17 / port 1/38
> > Oct 13 12:06:18:W:IP/ARP: IP address 194.68.129.yyy MAC movement
> > detected, changed from MAC 009b.0de4.41c0 / port 1/3 to MAC
> > 001b.0de4.41c0 / port 1/3
> > Oct 13 12:06:18:W:IP/ARP: IP address 194.68.129.yyy MAC movement
> > detected, changed from MAC 001b.0de4.41c0 / port 1/3 to MAC
> > 009b.0de4.41c0 / port 1/3
> >
> > I am pretty sure that the MACs are not really changing, as it is on
> > IXPs
> > where strict mac filtering is enabled. This happens on various
> > devices,
> > from various networks I manage. There is no operational problem,
> > apart
> > from fulfilling my log buffer
> >
> > Anyone aware of any kind of bug with that ?
> >
> > Thanks,
> >
> > --
> > Clément Cavadore
> >
> >
> > _______________________________________________
> > foundry-nsp mailing list
> > foundry-nsp@puck.nether.net
> > http://puck.nether.net/mailman/listinfo/foundry-nsp
>
> *----------- H U R R I C A N E - E L E C T R I C ---------->>
> | Mike Tindle | Senior Network Engineer | mtindle@he.net
> | ASN 6939 | http://www.he.net | 510-580-4126
> *--------------------------------------------------->>
>


_______________________________________________
foundry-nsp mailing list
foundry-nsp@puck.nether.net
http://puck.nether.net/mailman/listinfo/foundry-nsp


_______________________________________________
foundry-nsp mailing list
foundry-nsp@puck.nether.net
http://puck.nether.net/mailman/listinfo/foundry-nsp
Re: IP/ARP: IP address x.y.z.t MAC movement detected, changed from (...) [ In reply to ]
Would love to, if I had a support contract for that box :-)

On Mon, 2014-10-13 at 12:22 -0500, Frank Bulk wrote:
> Please open a ticket so that it becomes known, and report back the Defect number to us. =)
>
> Frank
>
> -----Original Message-----
> From: foundry-nsp [mailto:foundry-nsp-bounces@puck.nether.net] On Behalf Of Clement Cavadore
> Sent: Monday, October 13, 2014 12:19 PM
> To: Mike Tindle
> Cc: foundry-nsp@puck.nether.net
> Subject: Re: [f-nsp] IP/ARP: IP address x.y.z.t MAC movement detected, changed from (...)
>
> Hi Mike,
>
> Sure, but in an IXP context (especially AMS-IX :)), that would also
> remove the warning limit for the No. of prefix received from BGP
> peers... So I think I'd prefer having those, but still seeing the
> warning messages :)
>
> Btw, I hope that it's a known bug !
>
> Regards,
>


_______________________________________________
foundry-nsp mailing list
foundry-nsp@puck.nether.net
http://puck.nether.net/mailman/listinfo/foundry-nsp
Re: IP/ARP: IP address x.y.z.t MAC movement detected, changed from (...) [ In reply to ]
Hopefully someone else can open a ticket, then. I know that HE has Brocade's ear.

Frank

-----Original Message-----
From: Clement Cavadore [mailto:clement@cavadore.net]
Sent: Monday, October 13, 2014 12:24 PM
To: Frank Bulk
Cc: foundry-nsp@puck.nether.net
Subject: Re: [f-nsp] IP/ARP: IP address x.y.z.t MAC movement detected, changed from (...)

Would love to, if I had a support contract for that box :-)

On Mon, 2014-10-13 at 12:22 -0500, Frank Bulk wrote:
> Please open a ticket so that it becomes known, and report back the Defect number to us. =)
>
> Frank
>
> -----Original Message-----
> From: foundry-nsp [mailto:foundry-nsp-bounces@puck.nether.net] On Behalf Of Clement Cavadore
> Sent: Monday, October 13, 2014 12:19 PM
> To: Mike Tindle
> Cc: foundry-nsp@puck.nether.net
> Subject: Re: [f-nsp] IP/ARP: IP address x.y.z.t MAC movement detected, changed from (...)
>
> Hi Mike,
>
> Sure, but in an IXP context (especially AMS-IX :)), that would also
> remove the warning limit for the No. of prefix received from BGP
> peers... So I think I'd prefer having those, but still seeing the
> warning messages :)
>
> Btw, I hope that it's a known bug !
>
> Regards,
>





_______________________________________________
foundry-nsp mailing list
foundry-nsp@puck.nether.net
http://puck.nether.net/mailman/listinfo/foundry-nsp
Re: IP/ARP: IP address x.y.z.t MAC movement detected, changed from (...) [ In reply to ]
HI Clement,

> Sure, but in an IXP context (especially AMS-IX :)), that would also
> remove the warning limit for the No. of prefix received from BGP
> peers... So I think I'd prefer having those, but still seeing the
> warning messages :)


Caveat emptor. We chose not to implement it on other devices for different reasons. It knocks out a range of warnings.

> Hopefully someone else can open a ticket, then. I know that HE has Brocade's ear.


We didn't notice the warnings being issued incorrectly, we just weren’t able to resolve them in the affected devices environment. Since we didn’t see a situation where the warnings were actually in error, we are unable to open a bug report. We did notice that they began when we moved up to 5.6. We mentioned it to Brocade and they said it was a new and intentional warning.

I also asked them for the ability to silence those specific warnings but were presented with the aforementioned solution. I know some Brocade folks are on the list too, so they may be able to push a feature req for more fine grained logging filters. I’ll have to check if we actually put that in officially or just lamented to our rep. :)

Regards,
Mike

On Oct 13, 2014, at 10:19 AM, Clement Cavadore <clement@cavadore.net> wrote:

> Hi Mike,
>
> Sure, but in an IXP context (especially AMS-IX :)), that would also
> remove the warning limit for the No. of prefix received from BGP
> peers... So I think I'd prefer having those, but still seeing the
> warning messages :)
>
> Btw, I hope that it's a known bug !
>
> Regards,
>
> --
> Clément
>
> On Mon, 2014-10-13 at 10:12 -0700, Mike Tindle wrote:
>> If you cannot resolve the underlying cause and these are filling up
>> your logs, you can use:
>>
>>
>> no logging buffered warnings
>>
>>
>> However, keep in mind that does knock out some other messages that you
>> may not want to sacrifice logging. In one of our instances, the
>> tradeoff was worth it to implement the command.
>>
>>
>> Regards,
>> Mike
>>
>>
>>

*----------- H U R R I C A N E - E L E C T R I C ---------->>
| Mike Tindle | Senior Network Engineer | mtindle@he.net
| ASN 6939 | http://www.he.net | 510-580-4126
*--------------------------------------------------->>