Wireless MAC address for *.*.*.* has changed from --:--:--:--:--:-- to (S4 and wireless)

[Jeremy_Gibbs]

I am noticing this in the logs of the S4. Maybe this is normal, but take a look at the timestamp and the alternating mac addresses.

<165>Feb 1 17:23:38 10.0.1.1 RtrArpProc[3]MAC address for 10.10.41.133 has changed from 6c-94-f8-43-f4-f9 to a0-18-28-b2-2e-af [ARP rcvd on: lag.0.50] <165>Feb 1 17:24:49 10.0.1.1 RtrArpProc[3]MAC address for 10.10.41.133 has changed from a0-18-28-b2-2e-af to 6c-94-f8-43-f4-f9 [ARP rcvd on: lag.0.50] <165>Feb 1 17:25:04 10.0.1.1 RtrArpProc[3]MAC address for 10.10.41.133 has changed from 6c-94-f8-43-f4-f9 to a0-18-28-b2-2e-af [ARP rcvd on: lag.0.50] <165>Feb 1 17:26:19 10.0.1.1 RtrArpProc[3]MAC address for 10.10.41.133 has changed from a0-18-28-b2-2e-af to 6c-94-f8-43-f4-f9 [ARP rcvd on: lag.0.50] <165>Feb 1 17:26:29 10.0.1.1 RtrArpProc[3]MAC address for 10.10.41.133 has changed from 6c-94-f8-43-f4-f9 to a0-18-28-b2-2e-af [ARP rcvd on: lag.0.50] <165>Feb 1 17:27:49 10.0.1.1 RtrArpProc[3]MAC address for 10.10.41.133 has changed from a0-18-28-b2-2e-af to 6c-94-f8-43-f4-f9 [ARP rcvd on: lag.0.50] <165>Feb 1 17:28:01 10.0.1.1 RtrArpProc[3]MAC address for 10.10.41.133 has changed from 6c-94-f8-43-f4-f9 to a0-18-28-b2-2e-af [ARP rcvd on: lag.0.50] <165>Feb 1 17:29:19 10.0.1.1 RtrArpProc[3]MAC address for 10.10.41.133 has changed from a0-18-28-b2-2e-af to 6c-94-f8-43-f4-f9 [ARP rcvd on: lag.0.50] <165>Feb 1 17:29:48 10.0.1.1 RtrArpProc[3]MAC address for 10.10.41.133 has changed from 6c-94-f8-43-f4-f9 to a0-18-28-b2-2e-af [ARP rcvd on: lag.0.50] <165>Feb 1 17:30:49 10.0.1.1 RtrArpProc[3]MAC address for 10.10.41.133 has changed from a0-18-28-b2-2e-af to 6c-94-f8-43-f4-f9 [ARP rcvd on: lag.0.50] <165>Feb 1 17:31:18 10.0.1.1 RtrArpProc[3]MAC address for 10.10.41.133 has changed from 6c-94-f8-43-f4-f9 to a0-18-28-b2-2e-af [ARP rcvd on: lag.0.50] <165>Feb 1 17:32:19 10.0.1.1 RtrArpProc[3]MAC address for 10.10.41.133 has changed from a0-18-28-b2-2e-af to 6c-94-f8-43-f4-f9 [ARP rcvd on: lag.0.50] <165>Feb 1 17:32:40 10.0.1.1 RtrArpProc[3]MAC address for 10.10.41.133 has changed from 6c-94-f8-43-f4-f9 to a0-18-28-b2-2e-af [ARP rcvd on: lag.0.50] <165>Feb 1 17:33:49 10.0.1.1 RtrArpProc[3]MAC address for 10.10.41.133 has changed from a0-18-28-b2-2e-af to 6c-94-f8-43-f4-f9 [ARP rcvd on: lag.0.50] <165>Feb 1 17:33:57 10.0.1.1 RtrArpProc[3]MAC address for 10.10.41.133 has changed from 6c-94-f8-43-f4-f9 to a0-18-28-b2-2e-af [ARP rcvd on: lag.0.50] <165>Feb 1 17:35:19 10.0.1.1 RtrArpProc[3]MAC address for 10.10.41.133 has changed from a0-18-28-b2-2e-af to 6c-94-f8-43-f4-f9 [ARP rcvd on: lag.0.50] <165>Feb 1 17:35:42 10.0.1.1 RtrArpProc[3]MAC address for 10.10.41.133 has changed from 6c-94-f8-43-f4-f9 to a0-18-28-b2-2e-af [ARP rcvd on: lag.0.50] <165>Feb 1 17:36:23 10.0.1.1 RtrArpProc[3]MAC address for 10.10.41.133 has changed from a0-18-28-b2-2e-af to 6c-94-f8-43-f4-f9 [ARP rcvd on: lag.0.50] <165>Feb 1 17:36:41 10.0.1.1 RtrArpProc[3]MAC address for 10.10.41.133 has changed from 6c-94-f8-43-f4-f9 to a0-18-28-b2-2e-af [ARP rcvd on: lag.0.50] <165>Feb 1 17:37:07 10.0.1.1 RtrArpProc[3]MAC address for 10.10.41.133 has changed from a0-18-28-b2-2e-af to 6c-94-f8-43-f4-f9 [ARP rcvd on: lag.0.50] <165>Feb 1 17:37:18 10.0.1.1 RtrArpProc[3]MAC address for 10.10.41.133 has changed from 6c-94-f8-43-f4-f9 to a0-18-28-b2-2e-af [ARP rcvd on: lag.0.50] <165>Feb 1 17:37:53 10.0.1.1 RtrArpProc[3]MAC address for 10.10.41.133 has changed from a0-18-28-b2-2e-af to 6c-94-f8-43-f4-f9 [ARP rcvd on: lag.0.50] <165>Feb 1 17:38:11 10.0.1.1 RtrArpProc[3]MAC address for 10.10.41.133 has changed from 6c-94-f8-43-f4-f9 to a0-18-28-b2-2e-af [ARP rcvd on: lag.0.50] <165>Feb 1 17:38:15 10.0.1.1 RtrArpProc[3]MAC address for 10.10.41.133 has changed from a0-18-28-b2-2e-af to 6c-94-f8-43-f4-f9 [ARP rcvd on: lag.0.50] <165>Feb 1 17:38:48 10.0.1.1 RtrArpProc[3]MAC address for 10.10.41.133 has changed from 6c-94-f8-43-f4-f9 to a0-18-28-b2-2e-af [ARP rcvd on: lag.0.50] <165>Feb 1 17:39:23 10.0.1.1 RtrArpProc[3]MAC address for 10.10.41.133 has changed from a0-18-28-b2-2e-af to 6c-94-f8-43-f4-f9 [ARP rcvd on: lag.0.50] <165>Feb 1 17:39:59 10.0.1.1 RtrArpProc[3]MAC address for 10.10.41.133 has changed from 6c-94-f8-43-f4-f9 to a0-18-28-b2-2e-af [ARP rcvd on: lag.0.50] <165>Feb 1 17:40:53 10.0.1.1 RtrArpProc[3]MAC address for 10.10.41.133 has changed from a0-18-28-b2-2e-af to 6c-94-f8-43-f4-f9 [ARP rcvd on: lag.0.50] <165>Feb 1 17:41:48 10.0.1.1 RtrArpProc[3]MAC address for 10.10.41.133 has changed from 6c-94-f8-43-f4-f9 to a0-18-28-b2-2e-af [ARP rcvd on: lag.0.50] <165>Feb 1 17:42:23 10.0.1.1 RtrArpProc[3]MAC address for 10.10.41.133 has changed from a0-18-28-b2-2e-af to 6c-94-f8-43-f4-f9 [ARP rcvd on: lag.0.50] <165>Feb 1 17:43:18 10.0.1.1 RtrArpProc[3]MAC address for 10.10.41.133 has changed from 6c-94-f8-43-f4-f9 to a0-18-28-b2-2e-af [ARP rcvd on: lag.0.50] <165>Feb 1 17:43:53 10.0.1.1 RtrArpProc[3]MAC address for 10.10.41.133 has changed from a0-18-28-b2-2e-af to 6c-94-f8-43-f4-f9 [ARP rcvd on: lag.0.50] <165>Feb 1 17:44:04 10.0.1.1 RtrArpProc[3]MAC address for 10.10.41.133 has changed from 6c-94-f8-43-f4-f9 to a0-18-28-b2-2e-af [ARP rcvd on: lag.0.50] <165>Feb 1 17:45:01 10.0.1.1 RtrArpProc[3]MAC address for 10.10.41.133 has changed from a0-18-28-b2-2e-af to 6c-94-f8-43-f4-f9 [ARP rcvd on: lag.0.50]

[Anonymous]

A trace of the traffic would be good. Also tracking down the two devices in question and verifying someone didn't statically configure an IP would be good as well. If the messages are always just these 2 devices, I would lean towards a dup IP being manually configured.

[BrandonC]

It looks like this is happening fairly frequently, maybe you could catch it in a packet capture?

However, with both MACs being Apple MACs, I wouldn't be surprised to find out it's related to the Bonjour Sleep Proxy that James mentioned earlier.

[Jeremy_Gibbs]

Just checked and yes. Still seeing the message in the logs.

[Drew_C]

Hi Jeremy, Have you been able to get this one sorted out?