cancel
Showing results for 
Search instead for 
Did you mean: 

Wireless MAC address for *.*.*.* has changed from --:--:--:--:--:-- to (S4 and wireless)

Wireless MAC address for *.*.*.* has changed from --:--:--:--:--:-- to (S4 and wireless)

Jeremy_Gibbs
Contributor
I am noticing this in the logs of the S4. Maybe this is normal, but take a look at the timestamp and the alternating mac addresses.

<165>Feb 1 17:23:38 10.0.1.1 RtrArpProc[3]MAC address for 10.10.41.133 has changed from 6c-94-f8-43-f4-f9 to a0-18-28-b2-2e-af [ARP rcvd on: lag.0.50] <165>Feb 1 17:24:49 10.0.1.1 RtrArpProc[3]MAC address for 10.10.41.133 has changed from a0-18-28-b2-2e-af to 6c-94-f8-43-f4-f9 [ARP rcvd on: lag.0.50] <165>Feb 1 17:25:04 10.0.1.1 RtrArpProc[3]MAC address for 10.10.41.133 has changed from 6c-94-f8-43-f4-f9 to a0-18-28-b2-2e-af [ARP rcvd on: lag.0.50] <165>Feb 1 17:26:19 10.0.1.1 RtrArpProc[3]MAC address for 10.10.41.133 has changed from a0-18-28-b2-2e-af to 6c-94-f8-43-f4-f9 [ARP rcvd on: lag.0.50] <165>Feb 1 17:26:29 10.0.1.1 RtrArpProc[3]MAC address for 10.10.41.133 has changed from 6c-94-f8-43-f4-f9 to a0-18-28-b2-2e-af [ARP rcvd on: lag.0.50] <165>Feb 1 17:27:49 10.0.1.1 RtrArpProc[3]MAC address for 10.10.41.133 has changed from a0-18-28-b2-2e-af to 6c-94-f8-43-f4-f9 [ARP rcvd on: lag.0.50] <165>Feb 1 17:28:01 10.0.1.1 RtrArpProc[3]MAC address for 10.10.41.133 has changed from 6c-94-f8-43-f4-f9 to a0-18-28-b2-2e-af [ARP rcvd on: lag.0.50] <165>Feb 1 17:29:19 10.0.1.1 RtrArpProc[3]MAC address for 10.10.41.133 has changed from a0-18-28-b2-2e-af to 6c-94-f8-43-f4-f9 [ARP rcvd on: lag.0.50] <165>Feb 1 17:29:48 10.0.1.1 RtrArpProc[3]MAC address for 10.10.41.133 has changed from 6c-94-f8-43-f4-f9 to a0-18-28-b2-2e-af [ARP rcvd on: lag.0.50] <165>Feb 1 17:30:49 10.0.1.1 RtrArpProc[3]MAC address for 10.10.41.133 has changed from a0-18-28-b2-2e-af to 6c-94-f8-43-f4-f9 [ARP rcvd on: lag.0.50] <165>Feb 1 17:31:18 10.0.1.1 RtrArpProc[3]MAC address for 10.10.41.133 has changed from 6c-94-f8-43-f4-f9 to a0-18-28-b2-2e-af [ARP rcvd on: lag.0.50] <165>Feb 1 17:32:19 10.0.1.1 RtrArpProc[3]MAC address for 10.10.41.133 has changed from a0-18-28-b2-2e-af to 6c-94-f8-43-f4-f9 [ARP rcvd on: lag.0.50] <165>Feb 1 17:32:40 10.0.1.1 RtrArpProc[3]MAC address for 10.10.41.133 has changed from 6c-94-f8-43-f4-f9 to a0-18-28-b2-2e-af [ARP rcvd on: lag.0.50] <165>Feb 1 17:33:49 10.0.1.1 RtrArpProc[3]MAC address for 10.10.41.133 has changed from a0-18-28-b2-2e-af to 6c-94-f8-43-f4-f9 [ARP rcvd on: lag.0.50] <165>Feb 1 17:33:57 10.0.1.1 RtrArpProc[3]MAC address for 10.10.41.133 has changed from 6c-94-f8-43-f4-f9 to a0-18-28-b2-2e-af [ARP rcvd on: lag.0.50] <165>Feb 1 17:35:19 10.0.1.1 RtrArpProc[3]MAC address for 10.10.41.133 has changed from a0-18-28-b2-2e-af to 6c-94-f8-43-f4-f9 [ARP rcvd on: lag.0.50] <165>Feb 1 17:35:42 10.0.1.1 RtrArpProc[3]MAC address for 10.10.41.133 has changed from 6c-94-f8-43-f4-f9 to a0-18-28-b2-2e-af [ARP rcvd on: lag.0.50] <165>Feb 1 17:36:23 10.0.1.1 RtrArpProc[3]MAC address for 10.10.41.133 has changed from a0-18-28-b2-2e-af to 6c-94-f8-43-f4-f9 [ARP rcvd on: lag.0.50] <165>Feb 1 17:36:41 10.0.1.1 RtrArpProc[3]MAC address for 10.10.41.133 has changed from 6c-94-f8-43-f4-f9 to a0-18-28-b2-2e-af [ARP rcvd on: lag.0.50] <165>Feb 1 17:37:07 10.0.1.1 RtrArpProc[3]MAC address for 10.10.41.133 has changed from a0-18-28-b2-2e-af to 6c-94-f8-43-f4-f9 [ARP rcvd on: lag.0.50] <165>Feb 1 17:37:18 10.0.1.1 RtrArpProc[3]MAC address for 10.10.41.133 has changed from 6c-94-f8-43-f4-f9 to a0-18-28-b2-2e-af [ARP rcvd on: lag.0.50] <165>Feb 1 17:37:53 10.0.1.1 RtrArpProc[3]MAC address for 10.10.41.133 has changed from a0-18-28-b2-2e-af to 6c-94-f8-43-f4-f9 [ARP rcvd on: lag.0.50] <165>Feb 1 17:38:11 10.0.1.1 RtrArpProc[3]MAC address for 10.10.41.133 has changed from 6c-94-f8-43-f4-f9 to a0-18-28-b2-2e-af [ARP rcvd on: lag.0.50] <165>Feb 1 17:38:15 10.0.1.1 RtrArpProc[3]MAC address for 10.10.41.133 has changed from a0-18-28-b2-2e-af to 6c-94-f8-43-f4-f9 [ARP rcvd on: lag.0.50] <165>Feb 1 17:38:48 10.0.1.1 RtrArpProc[3]MAC address for 10.10.41.133 has changed from 6c-94-f8-43-f4-f9 to a0-18-28-b2-2e-af [ARP rcvd on: lag.0.50] <165>Feb 1 17:39:23 10.0.1.1 RtrArpProc[3]MAC address for 10.10.41.133 has changed from a0-18-28-b2-2e-af to 6c-94-f8-43-f4-f9 [ARP rcvd on: lag.0.50] <165>Feb 1 17:39:59 10.0.1.1 RtrArpProc[3]MAC address for 10.10.41.133 has changed from 6c-94-f8-43-f4-f9 to a0-18-28-b2-2e-af [ARP rcvd on: lag.0.50] <165>Feb 1 17:40:53 10.0.1.1 RtrArpProc[3]MAC address for 10.10.41.133 has changed from a0-18-28-b2-2e-af to 6c-94-f8-43-f4-f9 [ARP rcvd on: lag.0.50] <165>Feb 1 17:41:48 10.0.1.1 RtrArpProc[3]MAC address for 10.10.41.133 has changed from 6c-94-f8-43-f4-f9 to a0-18-28-b2-2e-af [ARP rcvd on: lag.0.50] <165>Feb 1 17:42:23 10.0.1.1 RtrArpProc[3]MAC address for 10.10.41.133 has changed from a0-18-28-b2-2e-af to 6c-94-f8-43-f4-f9 [ARP rcvd on: lag.0.50] <165>Feb 1 17:43:18 10.0.1.1 RtrArpProc[3]MAC address for 10.10.41.133 has changed from 6c-94-f8-43-f4-f9 to a0-18-28-b2-2e-af [ARP rcvd on: lag.0.50] <165>Feb 1 17:43:53 10.0.1.1 RtrArpProc[3]MAC address for 10.10.41.133 has changed from a0-18-28-b2-2e-af to 6c-94-f8-43-f4-f9 [ARP rcvd on: lag.0.50] <165>Feb 1 17:44:04 10.0.1.1 RtrArpProc[3]MAC address for 10.10.41.133 has changed from 6c-94-f8-43-f4-f9 to a0-18-28-b2-2e-af [ARP rcvd on: lag.0.50] <165>Feb 1 17:45:01 10.0.1.1 RtrArpProc[3]MAC address for 10.10.41.133 has changed from a0-18-28-b2-2e-af to 6c-94-f8-43-f4-f9 [ARP rcvd on: lag.0.50]
11 REPLIES 11

Anonymous
Not applicable
A trace of the traffic would be good. Also tracking down the two devices in question and verifying someone didn't statically configure an IP would be good as well. If the messages are always just these 2 devices, I would lean towards a dup IP being manually configured.

BrandonC
Extreme Employee
It looks like this is happening fairly frequently, maybe you could catch it in a packet capture?

However, with both MACs being Apple MACs, I wouldn't be surprised to find out it's related to the Bonjour Sleep Proxy that James mentioned earlier.

Jeremy_Gibbs
Contributor
Just checked and yes. Still seeing the message in the logs.

Drew_C
Valued Contributor III
Hi Jeremy, Have you been able to get this one sorted out?
GTM-P2G8KFN