Wireless MAC address for *.*.*.* has changed from --:--:--:--:--:-- to (S4 and wireless)

  • 0
  • 1
  • Question
  • Updated 3 years ago
  • Answered
  • (Edited)
I am noticing this in the logs of the S4.  Maybe this is normal, but take a look at the timestamp and the alternating mac addresses.

<165>Feb  1 17:23:38 10.0.1.1 RtrArpProc[3]MAC address for 10.10.41.133 has changed from 6c-94-f8-43-f4-f9 to a0-18-28-b2-2e-af [ARP rcvd on: lag.0.50]
<165>Feb  1 17:24:49 10.0.1.1 RtrArpProc[3]MAC address for 10.10.41.133 has changed from a0-18-28-b2-2e-af to 6c-94-f8-43-f4-f9 [ARP rcvd on: lag.0.50]
<165>Feb  1 17:25:04 10.0.1.1 RtrArpProc[3]MAC address for 10.10.41.133 has changed from 6c-94-f8-43-f4-f9 to a0-18-28-b2-2e-af [ARP rcvd on: lag.0.50]
<165>Feb  1 17:26:19 10.0.1.1 RtrArpProc[3]MAC address for 10.10.41.133 has changed from a0-18-28-b2-2e-af to 6c-94-f8-43-f4-f9 [ARP rcvd on: lag.0.50]
<165>Feb  1 17:26:29 10.0.1.1 RtrArpProc[3]MAC address for 10.10.41.133 has changed from 6c-94-f8-43-f4-f9 to a0-18-28-b2-2e-af [ARP rcvd on: lag.0.50]
<165>Feb  1 17:27:49 10.0.1.1 RtrArpProc[3]MAC address for 10.10.41.133 has changed from a0-18-28-b2-2e-af to 6c-94-f8-43-f4-f9 [ARP rcvd on: lag.0.50]
<165>Feb  1 17:28:01 10.0.1.1 RtrArpProc[3]MAC address for 10.10.41.133 has changed from 6c-94-f8-43-f4-f9 to a0-18-28-b2-2e-af [ARP rcvd on: lag.0.50]
<165>Feb  1 17:29:19 10.0.1.1 RtrArpProc[3]MAC address for 10.10.41.133 has changed from a0-18-28-b2-2e-af to 6c-94-f8-43-f4-f9 [ARP rcvd on: lag.0.50]
<165>Feb  1 17:29:48 10.0.1.1 RtrArpProc[3]MAC address for 10.10.41.133 has changed from 6c-94-f8-43-f4-f9 to a0-18-28-b2-2e-af [ARP rcvd on: lag.0.50]
<165>Feb  1 17:30:49 10.0.1.1 RtrArpProc[3]MAC address for 10.10.41.133 has changed from a0-18-28-b2-2e-af to 6c-94-f8-43-f4-f9 [ARP rcvd on: lag.0.50]
<165>Feb  1 17:31:18 10.0.1.1 RtrArpProc[3]MAC address for 10.10.41.133 has changed from 6c-94-f8-43-f4-f9 to a0-18-28-b2-2e-af [ARP rcvd on: lag.0.50]
<165>Feb  1 17:32:19 10.0.1.1 RtrArpProc[3]MAC address for 10.10.41.133 has changed from a0-18-28-b2-2e-af to 6c-94-f8-43-f4-f9 [ARP rcvd on: lag.0.50]
<165>Feb  1 17:32:40 10.0.1.1 RtrArpProc[3]MAC address for 10.10.41.133 has changed from 6c-94-f8-43-f4-f9 to a0-18-28-b2-2e-af [ARP rcvd on: lag.0.50]
<165>Feb  1 17:33:49 10.0.1.1 RtrArpProc[3]MAC address for 10.10.41.133 has changed from a0-18-28-b2-2e-af to 6c-94-f8-43-f4-f9 [ARP rcvd on: lag.0.50]
<165>Feb  1 17:33:57 10.0.1.1 RtrArpProc[3]MAC address for 10.10.41.133 has changed from 6c-94-f8-43-f4-f9 to a0-18-28-b2-2e-af [ARP rcvd on: lag.0.50]
<165>Feb  1 17:35:19 10.0.1.1 RtrArpProc[3]MAC address for 10.10.41.133 has changed from a0-18-28-b2-2e-af to 6c-94-f8-43-f4-f9 [ARP rcvd on: lag.0.50]
<165>Feb  1 17:35:42 10.0.1.1 RtrArpProc[3]MAC address for 10.10.41.133 has changed from 6c-94-f8-43-f4-f9 to a0-18-28-b2-2e-af [ARP rcvd on: lag.0.50]
<165>Feb  1 17:36:23 10.0.1.1 RtrArpProc[3]MAC address for 10.10.41.133 has changed from a0-18-28-b2-2e-af to 6c-94-f8-43-f4-f9 [ARP rcvd on: lag.0.50]
<165>Feb  1 17:36:41 10.0.1.1 RtrArpProc[3]MAC address for 10.10.41.133 has changed from 6c-94-f8-43-f4-f9 to a0-18-28-b2-2e-af [ARP rcvd on: lag.0.50]
<165>Feb  1 17:37:07 10.0.1.1 RtrArpProc[3]MAC address for 10.10.41.133 has changed from a0-18-28-b2-2e-af to 6c-94-f8-43-f4-f9 [ARP rcvd on: lag.0.50]
<165>Feb  1 17:37:18 10.0.1.1 RtrArpProc[3]MAC address for 10.10.41.133 has changed from 6c-94-f8-43-f4-f9 to a0-18-28-b2-2e-af [ARP rcvd on: lag.0.50]
<165>Feb  1 17:37:53 10.0.1.1 RtrArpProc[3]MAC address for 10.10.41.133 has changed from a0-18-28-b2-2e-af to 6c-94-f8-43-f4-f9 [ARP rcvd on: lag.0.50]
<165>Feb  1 17:38:11 10.0.1.1 RtrArpProc[3]MAC address for 10.10.41.133 has changed from 6c-94-f8-43-f4-f9 to a0-18-28-b2-2e-af [ARP rcvd on: lag.0.50]
<165>Feb  1 17:38:15 10.0.1.1 RtrArpProc[3]MAC address for 10.10.41.133 has changed from a0-18-28-b2-2e-af to 6c-94-f8-43-f4-f9 [ARP rcvd on: lag.0.50]
<165>Feb  1 17:38:48 10.0.1.1 RtrArpProc[3]MAC address for 10.10.41.133 has changed from 6c-94-f8-43-f4-f9 to a0-18-28-b2-2e-af [ARP rcvd on: lag.0.50]
<165>Feb  1 17:39:23 10.0.1.1 RtrArpProc[3]MAC address for 10.10.41.133 has changed from a0-18-28-b2-2e-af to 6c-94-f8-43-f4-f9 [ARP rcvd on: lag.0.50]
<165>Feb  1 17:39:59 10.0.1.1 RtrArpProc[3]MAC address for 10.10.41.133 has changed from 6c-94-f8-43-f4-f9 to a0-18-28-b2-2e-af [ARP rcvd on: lag.0.50]
<165>Feb  1 17:40:53 10.0.1.1 RtrArpProc[3]MAC address for 10.10.41.133 has changed from a0-18-28-b2-2e-af to 6c-94-f8-43-f4-f9 [ARP rcvd on: lag.0.50]
<165>Feb  1 17:41:48 10.0.1.1 RtrArpProc[3]MAC address for 10.10.41.133 has changed from 6c-94-f8-43-f4-f9 to a0-18-28-b2-2e-af [ARP rcvd on: lag.0.50]
<165>Feb  1 17:42:23 10.0.1.1 RtrArpProc[3]MAC address for 10.10.41.133 has changed from a0-18-28-b2-2e-af to 6c-94-f8-43-f4-f9 [ARP rcvd on: lag.0.50]
<165>Feb  1 17:43:18 10.0.1.1 RtrArpProc[3]MAC address for 10.10.41.133 has changed from 6c-94-f8-43-f4-f9 to a0-18-28-b2-2e-af [ARP rcvd on: lag.0.50]
<165>Feb  1 17:43:53 10.0.1.1 RtrArpProc[3]MAC address for 10.10.41.133 has changed from a0-18-28-b2-2e-af to 6c-94-f8-43-f4-f9 [ARP rcvd on: lag.0.50]
<165>Feb  1 17:44:04 10.0.1.1 RtrArpProc[3]MAC address for 10.10.41.133 has changed from 6c-94-f8-43-f4-f9 to a0-18-28-b2-2e-af [ARP rcvd on: lag.0.50]
<165>Feb  1 17:45:01 10.0.1.1 RtrArpProc[3]MAC address for 10.10.41.133 has changed from a0-18-28-b2-2e-af to 6c-94-f8-43-f4-f9 [ARP rcvd on: lag.0.50]
Photo of Jeremy

Jeremy, Embassador

  • 9,788 Points 5k badge 2x thumb

Posted 3 years ago

  • 0
  • 1
Photo of Jeremy

Jeremy, Embassador

  • 9,788 Points 5k badge 2x thumb
DHCP lease time is 4 hours.  This is on wireless (Extreme Identifi Wireless).  
Photo of Pala, Zdenek

Pala, Zdenek, Employee

  • 9,834 Points 5k badge 2x thumb
I would guess you have IP duplicity = conflict
Photo of Jeremy

Jeremy, Embassador

  • 9,788 Points 5k badge 2x thumb
That is what I am thinking.  But how and why!!?  I don't manage DHCP so this is out of my hands.
Photo of Joseph Burnsworth

Joseph Burnsworth

  • 2,328 Points 2k badge 2x thumb
I would think that one device has a static address and one is getting DHCP

Doing a mac address lookup, they are both Apple Devices. Would you happen to have any Apple TV's on the same subnet and statically assigned?
Photo of Jeremy

Jeremy, Embassador

  • 9,788 Points 5k badge 2x thumb
I doubt it. Looking at them in NAC, one is an iPhone iPad etc. ther other I think is a MBP. We don't assign static ips, we would make a dhcp reservation for it. There are also a lot more of these messages. 205,000 + in the last few months. Also, no rogue dhcp servers.
Photo of James A

James A, Embassador

  • 7,338 Points 5k badge 2x thumb
You could be seeing Bonjour Sleep Proxy taking over the IP address. "Computers running Mac OS X Snow Leopard act as a Bonjour sleep proxy server when Internet sharing is enabled."
Photo of Jeremy

Jeremy, Embassador

  • 9,788 Points 5k badge 2x thumb
2 Different users in NAC, connecting from two different locations on wireless. 
Photo of Drew C.

Drew C., Community Manager

  • 40,206 Points 20k badge 2x thumb
Hi Jeremy, Have you been able to get this one sorted out?
Photo of Jeremy

Jeremy, Embassador

  • 9,788 Points 5k badge 2x thumb
Just checked and yes.  Still seeing the message in the logs. 
Photo of Brandon Clay

Brandon Clay, Escalation Support Engineer

  • 13,486 Points 10k badge 2x thumb
It looks like this is happening fairly frequently, maybe you could catch it in a packet capture? 

However, with both MACs being Apple MACs, I wouldn't be surprised to find out it's related to the Bonjour Sleep Proxy that James mentioned earlier.
Photo of George, Chris

George, Chris, Employee

  • 992 Points 500 badge 2x thumb
A trace of the traffic would be good.  Also tracking down the two devices in question and verifying someone didn't statically configure an IP would be good as well.  If the messages are always just these 2 devices, I would lean towards a dup IP being manually configured.