[prev in list] [next in list] [prev in thread] [next in thread]
List: foundry-nsp
Subject: Re: [f-nsp] IP/ARP: IP address x.y.z.t MAC movement detected, changed from (...)
From: Youssef Bengelloun-Zahr <youssef () 720 ! fr>
Date: 2014-10-13 12:17:16
Message-ID: CALHo_yA4yF8HN4niW=NU12Cx3baTfOZiP-LXv=mtv3FrJ_YQBg () mail ! gmail ! com
[Download RAW message or body]
[Attachment #2 (multipart/related)]
[Attachment #4 (multipart/alternative)]
Hello Clement, All,
Let's add this one to this list of NI oddities [?]
Best regards.
2014-10-13 13:36 GMT+02:00 Clement Cavadore <clement@cavadore.net>:
> Seems that I am not alone:
>
> http://community.brocade.com/t5/Ethernet-Switches-Routers/Getting-log-message-MAC-movement-detected-after-code-upgrade-to/td-p/66490
>
> Regards,
>
> --
> Clément Cavadore
>
> On Mon, 2014-10-13 at 13:34 +0200, Clement Cavadore wrote:
> > Hi,
> >
> > After upgrading to 5.6 (CER devices), we keep having the following
> > messages:
> >
> > Oct 13 12:46:03:W:IP/ARP: IP address 194.68.129.xxx MAC movement
> detected, changed from MAC 0022.83d4.1ff0 / port 1/3 to MAC 0022.8354.1ff0
> / port 1/3
> > Oct 13 12:46:02:W:IP/ARP: IP address 194.68.129.xxx MAC movement
> detected, changed from MAC 0022.8354.1ff0 / port 1/3 to MAC 0022.83d4.1ff0
> / port 1/3
> > Oct 13 12:44:13:W:IP/ARP: IP address 194.68.129.xxx MAC movement
> detected, changed from MAC 0022.83d4.1ff0 / port 1/3 to MAC 0022.8354.1ff0
> / port 1/3
> > Oct 13 12:44:09:W:IP/ARP: IP address 194.68.129.xxx MAC movement
> detected, changed from MAC 0022.8354.1ff0 / port 1/3 to MAC 0022.83d4.1ff0
> / port 1/3
> > Oct 13 12:40:14:W:IP/ARP: IP address 194.68.129.yyy MAC movement
> detected, changed from MAC 009b.0de4.41c0 / port 1/3 to MAC 001b.0de4.41c0
> / port 1/3
> > Oct 13 12:40:14:W:IP/ARP: IP address 194.68.129.yyy MAC movement
> detected, changed from MAC 001b.0de4.41c0 / port 1/3 to MAC 009b.0de4.41c0
> / port 1/3
> > Oct 13 12:37:40:W:IP/ARP: IP address 194.68.129.yyy MAC movement
> detected, changed from MAC 009b.0de4.41c0 / port 1/3 to MAC 001b.0de4.41c0
> / port 1/3
> > Oct 13 12:37:40:W:IP/ARP: IP address 194.68.129.yyy MAC movement
> detected, changed from MAC 001b.0de4.41c0 / port 1/3 to MAC 009b.0de4.41c0
> / port 1/3
> > Oct 13 12:16:50:W:IP/ARP: IP address 194.68.129.yyy MAC movement
> detected, changed from MAC 009b.0de4.41c0 / port 1/3 to MAC 001b.0de4.41c0
> / port 1/3
> > Oct 13 12:16:50:W:IP/ARP: IP address 194.68.129.yyy MAC movement
> detected, changed from MAC 001b.0de4.41c0 / port 1/3 to MAC 009b.0de4.41c0
> / port 1/3
> > Oct 13 12:12:02:W:IP/ARP: IP address 194.68.129.yyy MAC movement
> detected, changed from MAC 009b.0de4.41c0 / port 1/3 to MAC 001b.0de4.41c0
> / port 1/3
> > Oct 13 12:12:02:W:IP/ARP: IP address 194.68.129.yyy MAC movement
> detected, changed from MAC 001b.0de4.41c0 / port 1/3 to MAC 009b.0de4.41c0
> / port 1/3
> > Oct 13 12:11:44:W:IP/ARP: IP address 194.68.129.yyy MAC movement
> detected, changed from MAC 009b.0de4.41c0 / port 1/3 to MAC 001b.0de4.41c0
> / port 1/3
> > Oct 13 12:11:44:W:IP/ARP: IP address 194.68.129.yyy MAC movement
> detected, changed from MAC 001b.0de4.41c0 / port 1/3 to MAC 009b.0de4.41c0
> / port 1/3
> > Oct 13 12:10:16:W:IP/ARP: IP address 80.249.208.zzz MAC movement
> detected, changed from MAC 0025.900a.0c17 / port 1/38 to MAC 000e.d6b5.7c00
> / port 1/38
> > Oct 13 12:09:33:W:IP/ARP: IP address 80.249.208.zzz MAC movement
> detected, changed from MAC 000e.d6b5.7c00 / port 1/38 to MAC 0025.900a.0c17
> / port 1/38
> > Oct 13 12:06:18:W:IP/ARP: IP address 194.68.129.yyy MAC movement
> detected, changed from MAC 009b.0de4.41c0 / port 1/3 to MAC 001b.0de4.41c0
> / port 1/3
> > Oct 13 12:06:18:W:IP/ARP: IP address 194.68.129.yyy MAC movement
> detected, changed from MAC 001b.0de4.41c0 / port 1/3 to MAC 009b.0de4.41c0
> / port 1/3
> >
> > I am pretty sure that the MACs are not really changing, as it is on IXPs
> > where strict mac filtering is enabled. This happens on various devices,
> > from various networks I manage. There is no operational problem, apart
> > from fulfilling my log buffer
> >
> > Anyone aware of any kind of bug with that ?
> >
> > Thanks,
> >
>
>
> _______________________________________________
> foundry-nsp mailing list
> foundry-nsp@puck.nether.net
> http://puck.nether.net/mailman/listinfo/foundry-nsp
>
--
Youssef BENGELLOUN-ZAHR
[Attachment #7 (text/html)]
<div dir="ltr"><div><div>Hello Clement, All,<br><br></div>Let's add this one to \
this list of NI oddities <img goomoji="360" style="margin: 0px 0.2ex; vertical-align: \
middle;" src="cid:360@goomoji.gmail"><br><br></div>Best regards.<br><br><br><div \
class="gmail_extra"><br><div class="gmail_quote">2014-10-13 13:36 GMT+02:00 Clement \
Cavadore <span dir="ltr"><<a href="mailto:clement@cavadore.net" \
target="_blank">clement@cavadore.net</a>></span>:<br><blockquote \
class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc \
solid;padding-left:1ex">Seems that I am not alone:<br> <a \
href="http://community.brocade.com/t5/Ethernet-Switches-Routers/Getting-log-message-MAC-movement-detected-after-code-upgrade-to/td-p/66490" \
target="_blank">http://community.brocade.com/t5/Ethernet-Switches-Routers/Getting-log-message-MAC-movement-detected-after-code-upgrade-to/td-p/66490</a><br>
<br>
Regards,<br>
<span class="HOEnZb"><font color="#888888"><br>
--<br>
Clément Cavadore<br>
</font></span><div class="HOEnZb"><div class="h5"><br>
On Mon, 2014-10-13 at 13:34 +0200, Clement Cavadore wrote:<br>
> Hi,<br>
><br>
> After upgrading to 5.6 (CER devices), we keep having the following<br>
> messages:<br>
><br>
> Oct 13 12:46:03:W:IP/ARP: IP address 194.68.129.xxx MAC movement detected, \
changed from MAC 0022.83d4.1ff0 / port 1/3 to MAC 0022.8354.1ff0 / port 1/3<br> > \
Oct 13 12:46:02:W:IP/ARP: IP address 194.68.129.xxx MAC movement detected, changed \
from MAC 0022.8354.1ff0 / port 1/3 to MAC 0022.83d4.1ff0 / port 1/3<br> > Oct 13 \
12:44:13:W:IP/ARP: IP address 194.68.129.xxx MAC movement detected, changed from MAC \
0022.83d4.1ff0 / port 1/3 to MAC 0022.8354.1ff0 / port 1/3<br> > Oct 13 \
12:44:09:W:IP/ARP: IP address 194.68.129.xxx MAC movement detected, changed from MAC \
0022.8354.1ff0 / port 1/3 to MAC 0022.83d4.1ff0 / port 1/3<br> > Oct 13 \
12:40:14:W:IP/ARP: IP address 194.68.129.yyy MAC movement detected, changed from MAC \
009b.0de4.41c0 / port 1/3 to MAC 001b.0de4.41c0 / port 1/3<br> > Oct 13 \
12:40:14:W:IP/ARP: IP address 194.68.129.yyy MAC movement detected, changed from MAC \
001b.0de4.41c0 / port 1/3 to MAC 009b.0de4.41c0 / port 1/3<br> > Oct 13 \
12:37:40:W:IP/ARP: IP address 194.68.129.yyy MAC movement detected, changed from MAC \
009b.0de4.41c0 / port 1/3 to MAC 001b.0de4.41c0 / port 1/3<br> > Oct 13 \
12:37:40:W:IP/ARP: IP address 194.68.129.yyy MAC movement detected, changed from MAC \
001b.0de4.41c0 / port 1/3 to MAC 009b.0de4.41c0 / port 1/3<br> > Oct 13 \
12:16:50:W:IP/ARP: IP address 194.68.129.yyy MAC movement detected, changed from MAC \
009b.0de4.41c0 / port 1/3 to MAC 001b.0de4.41c0 / port 1/3<br> > Oct 13 \
12:16:50:W:IP/ARP: IP address 194.68.129.yyy MAC movement detected, changed from MAC \
001b.0de4.41c0 / port 1/3 to MAC 009b.0de4.41c0 / port 1/3<br> > Oct 13 \
12:12:02:W:IP/ARP: IP address 194.68.129.yyy MAC movement detected, changed from MAC \
009b.0de4.41c0 / port 1/3 to MAC 001b.0de4.41c0 / port 1/3<br> > Oct 13 \
12:12:02:W:IP/ARP: IP address 194.68.129.yyy MAC movement detected, changed from MAC \
001b.0de4.41c0 / port 1/3 to MAC 009b.0de4.41c0 / port 1/3<br> > Oct 13 \
12:11:44:W:IP/ARP: IP address 194.68.129.yyy MAC movement detected, changed from MAC \
009b.0de4.41c0 / port 1/3 to MAC 001b.0de4.41c0 / port 1/3<br> > Oct 13 \
12:11:44:W:IP/ARP: IP address 194.68.129.yyy MAC movement detected, changed from MAC \
001b.0de4.41c0 / port 1/3 to MAC 009b.0de4.41c0 / port 1/3<br> > Oct 13 \
12:10:16:W:IP/ARP: IP address 80.249.208.zzz MAC movement detected, changed from MAC \
0025.900a.0c17 / port 1/38 to MAC 000e.d6b5.7c00 / port 1/38<br> > Oct 13 \
12:09:33:W:IP/ARP: IP address 80.249.208.zzz MAC movement detected, changed from MAC \
000e.d6b5.7c00 / port 1/38 to MAC 0025.900a.0c17 / port 1/38<br> > Oct 13 \
12:06:18:W:IP/ARP: IP address 194.68.129.yyy MAC movement detected, changed from MAC \
009b.0de4.41c0 / port 1/3 to MAC 001b.0de4.41c0 / port 1/3<br> > Oct 13 \
12:06:18:W:IP/ARP: IP address 194.68.129.yyy MAC movement detected, changed from MAC \
001b.0de4.41c0 / port 1/3 to MAC 009b.0de4.41c0 / port 1/3<br> ><br>
> I am pretty sure that the MACs are not really changing, as it is on IXPs<br>
> where strict mac filtering is enabled. This happens on various devices,<br>
> from various networks I manage. There is no operational problem, apart<br>
> from fulfilling my log buffer<br>
><br>
> Anyone aware of any kind of bug with that ?<br>
><br>
> Thanks,<br>
><br>
<br>
<br>
</div></div><div class="HOEnZb"><div \
class="h5">_______________________________________________<br> foundry-nsp mailing \
list<br> <a href="mailto:foundry-nsp@puck.nether.net">foundry-nsp@puck.nether.net</a><br>
<a href="http://puck.nether.net/mailman/listinfo/foundry-nsp" \
target="_blank">http://puck.nether.net/mailman/listinfo/foundry-nsp</a></div></div></blockquote></div><br><br \
clear="all"><br>-- <br>Youssef BENGELLOUN-ZAHR<br> </div></div>
--20cf30266dc020332205054ce1ec--
["360.gif" (image/gif)]
_______________________________________________
foundry-nsp mailing list
foundry-nsp@puck.nether.net
http://puck.nether.net/mailman/listinfo/foundry-nsp
[prev in list] [next in list] [prev in thread] [next in thread]
Configure |
About |
News |
Add a list |
Sponsored by KoreLogic