topic RE: Wireless MAC address for ... has changed from --:--:--:--:--:-- to (S4 and wireless) in ExtremeWireless (Identifi)

Wireless MAC address for ... has changed from --:--:--:--:--:-- to (S4 and wireless)

Jeremy_Gibbs — Tue, 02 Feb 2016 06:27:00 GMT

I am noticing this in the logs of the S4. Maybe this is normal, but take a look at the timestamp and the alternating mac addresses.

<165>Feb 1 17:23:38 10.0.1.1 RtrArpProc[3]MAC address for 10.10.41.133 has changed from 6c-94-f8-43-f4-f9 to a0-18-28-b2-2e-af [ARP rcvd on: lag.0.50] <165>Feb 1 17:24:49 10.0.1.1 RtrArpProc[3]MAC address for 10.10.41.133 has changed from a0-18-28-b2-2e-af to 6c-94-f8-43-f4-f9 [ARP rcvd on: lag.0.50] <165>Feb 1 17:25:04 10.0.1.1 RtrArpProc[3]MAC address for 10.10.41.133 has changed from 6c-94-f8-43-f4-f9 to a0-18-28-b2-2e-af [ARP rcvd on: lag.0.50] <165>Feb 1 17:26:19 10.0.1.1 RtrArpProc[3]MAC address for 10.10.41.133 has changed from a0-18-28-b2-2e-af to 6c-94-f8-43-f4-f9 [ARP rcvd on: lag.0.50] <165>Feb 1 17:26:29 10.0.1.1 RtrArpProc[3]MAC address for 10.10.41.133 has changed from 6c-94-f8-43-f4-f9 to a0-18-28-b2-2e-af [ARP rcvd on: lag.0.50] <165>Feb 1 17:27:49 10.0.1.1 RtrArpProc[3]MAC address for 10.10.41.133 has changed from a0-18-28-b2-2e-af to 6c-94-f8-43-f4-f9 [ARP rcvd on: lag.0.50] <165>Feb 1 17:28:01 10.0.1.1 RtrArpProc[3]MAC address for 10.10.41.133 has changed from 6c-94-f8-43-f4-f9 to a0-18-28-b2-2e-af [ARP rcvd on: lag.0.50] <165>Feb 1 17:29:19 10.0.1.1 RtrArpProc[3]MAC address for 10.10.41.133 has changed from a0-18-28-b2-2e-af to 6c-94-f8-43-f4-f9 [ARP rcvd on: lag.0.50] <165>Feb 1 17:29:48 10.0.1.1 RtrArpProc[3]MAC address for 10.10.41.133 has changed from 6c-94-f8-43-f4-f9 to a0-18-28-b2-2e-af [ARP rcvd on: lag.0.50] <165>Feb 1 17:30:49 10.0.1.1 RtrArpProc[3]MAC address for 10.10.41.133 has changed from a0-18-28-b2-2e-af to 6c-94-f8-43-f4-f9 [ARP rcvd on: lag.0.50] <165>Feb 1 17:31:18 10.0.1.1 RtrArpProc[3]MAC address for 10.10.41.133 has changed from 6c-94-f8-43-f4-f9 to a0-18-28-b2-2e-af [ARP rcvd on: lag.0.50] <165>Feb 1 17:32:19 10.0.1.1 RtrArpProc[3]MAC address for 10.10.41.133 has changed from a0-18-28-b2-2e-af to 6c-94-f8-43-f4-f9 [ARP rcvd on: lag.0.50] <165>Feb 1 17:32:40 10.0.1.1 RtrArpProc[3]MAC address for 10.10.41.133 has changed from 6c-94-f8-43-f4-f9 to a0-18-28-b2-2e-af [ARP rcvd on: lag.0.50] <165>Feb 1 17:33:49 10.0.1.1 RtrArpProc[3]MAC address for 10.10.41.133 has changed from a0-18-28-b2-2e-af to 6c-94-f8-43-f4-f9 [ARP rcvd on: lag.0.50] <165>Feb 1 17:33:57 10.0.1.1 RtrArpProc[3]MAC address for 10.10.41.133 has changed from 6c-94-f8-43-f4-f9 to a0-18-28-b2-2e-af [ARP rcvd on: lag.0.50] <165>Feb 1 17:35:19 10.0.1.1 RtrArpProc[3]MAC address for 10.10.41.133 has changed from a0-18-28-b2-2e-af to 6c-94-f8-43-f4-f9 [ARP rcvd on: lag.0.50] <165>Feb 1 17:35:42 10.0.1.1 RtrArpProc[3]MAC address for 10.10.41.133 has changed from 6c-94-f8-43-f4-f9 to a0-18-28-b2-2e-af [ARP rcvd on: lag.0.50] <165>Feb 1 17:36:23 10.0.1.1 RtrArpProc[3]MAC address for 10.10.41.133 has changed from a0-18-28-b2-2e-af to 6c-94-f8-43-f4-f9 [ARP rcvd on: lag.0.50] <165>Feb 1 17:36:41 10.0.1.1 RtrArpProc[3]MAC address for 10.10.41.133 has changed from 6c-94-f8-43-f4-f9 to a0-18-28-b2-2e-af [ARP rcvd on: lag.0.50] <165>Feb 1 17:37:07 10.0.1.1 RtrArpProc[3]MAC address for 10.10.41.133 has changed from a0-18-28-b2-2e-af to 6c-94-f8-43-f4-f9 [ARP rcvd on: lag.0.50] <165>Feb 1 17:37:18 10.0.1.1 RtrArpProc[3]MAC address for 10.10.41.133 has changed from 6c-94-f8-43-f4-f9 to a0-18-28-b2-2e-af [ARP rcvd on: lag.0.50] <165>Feb 1 17:37:53 10.0.1.1 RtrArpProc[3]MAC address for 10.10.41.133 has changed from a0-18-28-b2-2e-af to 6c-94-f8-43-f4-f9 [ARP rcvd on: lag.0.50] <165>Feb 1 17:38:11 10.0.1.1 RtrArpProc[3]MAC address for 10.10.41.133 has changed from 6c-94-f8-43-f4-f9 to a0-18-28-b2-2e-af [ARP rcvd on: lag.0.50] <165>Feb 1 17:38:15 10.0.1.1 RtrArpProc[3]MAC address for 10.10.41.133 has changed from a0-18-28-b2-2e-af to 6c-94-f8-43-f4-f9 [ARP rcvd on: lag.0.50] <165>Feb 1 17:38:48 10.0.1.1 RtrArpProc[3]MAC address for 10.10.41.133 has changed from 6c-94-f8-43-f4-f9 to a0-18-28-b2-2e-af [ARP rcvd on: lag.0.50] <165>Feb 1 17:39:23 10.0.1.1 RtrArpProc[3]MAC address for 10.10.41.133 has changed from a0-18-28-b2-2e-af to 6c-94-f8-43-f4-f9 [ARP rcvd on: lag.0.50] <165>Feb 1 17:39:59 10.0.1.1 RtrArpProc[3]MAC address for 10.10.41.133 has changed from 6c-94-f8-43-f4-f9 to a0-18-28-b2-2e-af [ARP rcvd on: lag.0.50] <165>Feb 1 17:40:53 10.0.1.1 RtrArpProc[3]MAC address for 10.10.41.133 has changed from a0-18-28-b2-2e-af to 6c-94-f8-43-f4-f9 [ARP rcvd on: lag.0.50] <165>Feb 1 17:41:48 10.0.1.1 RtrArpProc[3]MAC address for 10.10.41.133 has changed from 6c-94-f8-43-f4-f9 to a0-18-28-b2-2e-af [ARP rcvd on: lag.0.50] <165>Feb 1 17:42:23 10.0.1.1 RtrArpProc[3]MAC address for 10.10.41.133 has changed from a0-18-28-b2-2e-af to 6c-94-f8-43-f4-f9 [ARP rcvd on: lag.0.50] <165>Feb 1 17:43:18 10.0.1.1 RtrArpProc[3]MAC address for 10.10.41.133 has changed from 6c-94-f8-43-f4-f9 to a0-18-28-b2-2e-af [ARP rcvd on: lag.0.50] <165>Feb 1 17:43:53 10.0.1.1 RtrArpProc[3]MAC address for 10.10.41.133 has changed from a0-18-28-b2-2e-af to 6c-94-f8-43-f4-f9 [ARP rcvd on: lag.0.50] <165>Feb 1 17:44:04 10.0.1.1 RtrArpProc[3]MAC address for 10.10.41.133 has changed from 6c-94-f8-43-f4-f9 to a0-18-28-b2-2e-af [ARP rcvd on: lag.0.50] <165>Feb 1 17:45:01 10.0.1.1 RtrArpProc[3]MAC address for 10.10.41.133 has changed from a0-18-28-b2-2e-af to 6c-94-f8-43-f4-f9 [ARP rcvd on: lag.0.50]

RE: Wireless MAC address for ... has changed from --:--:--:--:--:-- to (S4 and wireless)

Jeremy_Gibbs — Tue, 02 Feb 2016 06:29:00 GMT

DHCP lease time is 4 hours. This is on wireless (Extreme Identifi Wireless).

RE: Wireless MAC address for ... has changed from --:--:--:--:--:-- to (S4 and wireless)

Zdeněk_Pala — Tue, 02 Feb 2016 06:49:00 GMT

I would guess you have IP duplicity = conflict

RE: Wireless MAC address for ... has changed from --:--:--:--:--:-- to (S4 and wireless)

Jeremy_Gibbs — Tue, 02 Feb 2016 07:34:00 GMT

That is what I am thinking. But how and why!!? I don't manage DHCP so this is out of my hands.

RE: Wireless MAC address for ... has changed from --:--:--:--:--:-- to (S4 and wireless)

Joseph_Burnswor — Tue, 02 Feb 2016 08:46:00 GMT

I would think that one device has a static address and one is getting DHCP

Doing a mac address lookup, they are both Apple Devices. Would you happen to have any Apple TV's on the same subnet and statically assigned?

RE: Wireless MAC address for ... has changed from --:--:--:--:--:-- to (S4 and wireless)

Jeremy_Gibbs — Tue, 02 Feb 2016 09:23:00 GMT

I doubt it. Looking at them in NAC, one is an iPhone iPad etc. ther other I think is a MBP. We don't assign static ips, we would make a dhcp reservation for it. There are also a lot more of these messages. 205,000 + in the last few months. Also, no rogue dhcp servers.

RE: Wireless MAC address for ... has changed from --:--:--:--:--:-- to (S4 and wireless)

Jeremy_Gibbs — Tue, 02 Feb 2016 13:23:00 GMT

2 Different users in NAC, connecting from two different locations on wireless.

RE: Wireless MAC address for ... has changed from --:--:--:--:--:-- to (S4 and wireless)

Drew_C — Wed, 24 Feb 2016 04:30:00 GMT

Hi Jeremy, Have you been able to get this one sorted out?

RE: Wireless MAC address for ... has changed from --:--:--:--:--:-- to (S4 and wireless)

Jeremy_Gibbs — Wed, 24 Feb 2016 04:35:00 GMT

Just checked and yes. Still seeing the message in the logs.

RE: Wireless MAC address for ... has changed from --:--:--:--:--:-- to (S4 and wireless)

BrandonC — Wed, 24 Feb 2016 05:22:00 GMT

It looks like this is happening fairly frequently, maybe you could catch it in a packet capture?

However, with both MACs being Apple MACs, I wouldn't be surprised to find out it's related to the Bonjour Sleep Proxy that James mentioned earlier.

RE: Wireless MAC address for ... has changed from --:--:--:--:--:-- to (S4 and wireless)

Anonymous — Wed, 24 Feb 2016 21:56:00 GMT

A trace of the traffic would be good. Also tracking down the two devices in question and verifying someone didn't statically configure an IP would be good as well. If the messages are always just these 2 devices, I would lean towards a dup IP being manually configured.

topic RE: Wireless MAC address for *.*.*.* has changed from --:--:--:--:--:-- to (S4 and wireless) in ExtremeWireless (Identifi)

Wireless MAC address for *.*.*.* has changed from --:--:--:--:--:-- to (S4 and wireless)

RE: Wireless MAC address for *.*.*.* has changed from --:--:--:--:--:-- to (S4 and wireless)

RE: Wireless MAC address for *.*.*.* has changed from --:--:--:--:--:-- to (S4 and wireless)

RE: Wireless MAC address for *.*.*.* has changed from --:--:--:--:--:-- to (S4 and wireless)

RE: Wireless MAC address for *.*.*.* has changed from --:--:--:--:--:-- to (S4 and wireless)

RE: Wireless MAC address for *.*.*.* has changed from --:--:--:--:--:-- to (S4 and wireless)

RE: Wireless MAC address for *.*.*.* has changed from --:--:--:--:--:-- to (S4 and wireless)

RE: Wireless MAC address for *.*.*.* has changed from --:--:--:--:--:-- to (S4 and wireless)

RE: Wireless MAC address for *.*.*.* has changed from --:--:--:--:--:-- to (S4 and wireless)

RE: Wireless MAC address for *.*.*.* has changed from --:--:--:--:--:-- to (S4 and wireless)

RE: Wireless MAC address for *.*.*.* has changed from --:--:--:--:--:-- to (S4 and wireless)

topic RE: Wireless MAC address for ... has changed from --:--:--:--:--:-- to (S4 and wireless) in ExtremeWireless (Identifi)

Wireless MAC address for ... has changed from --:--:--:--:--:-- to (S4 and wireless)

RE: Wireless MAC address for ... has changed from --:--:--:--:--:-- to (S4 and wireless)

RE: Wireless MAC address for ... has changed from --:--:--:--:--:-- to (S4 and wireless)

RE: Wireless MAC address for ... has changed from --:--:--:--:--:-- to (S4 and wireless)

RE: Wireless MAC address for ... has changed from --:--:--:--:--:-- to (S4 and wireless)

RE: Wireless MAC address for ... has changed from --:--:--:--:--:-- to (S4 and wireless)

RE: Wireless MAC address for ... has changed from --:--:--:--:--:-- to (S4 and wireless)

RE: Wireless MAC address for ... has changed from --:--:--:--:--:-- to (S4 and wireless)

RE: Wireless MAC address for ... has changed from --:--:--:--:--:-- to (S4 and wireless)

RE: Wireless MAC address for ... has changed from --:--:--:--:--:-- to (S4 and wireless)

RE: Wireless MAC address for ... has changed from --:--:--:--:--:-- to (S4 and wireless)