Wireless MAC address for *.*.*.* has changed from --:--:--:--:--:-- to (S4 and wireless)

[Jeremy_Gibbs]

I am noticing this in the logs of the S4. Maybe this is normal, but take a look at the timestamp and the alternating mac addresses.

<165>Feb 1 17:23:38 10.0.1.1 RtrArpProc[3]MAC address for 10.10.41.133 has changed from 6c-94-f8-43-f4-f9 to a0-18-28-b2-2e-af [ARP rcvd on: lag.0.50] <165>Feb 1 17:24:49 10.0.1.1 RtrArpProc[3]MAC address for 10.10.41.133 has changed from a0-18-28-b2-2e-af to 6c-94-f8-43-f4-f9 [ARP rcvd on: lag.0.50] <165>Feb 1 17:25:04 10.0.1.1 RtrArpProc[3]MAC address for 10.10.41.133 has changed from 6c-94-f8-43-f4-f9 to a0-18-28-b2-2e-af [ARP rcvd on: lag.0.50] <165>Feb 1 17:26:19 10.0.1.1 RtrArpProc[3]MAC address for 10.10.41.133 has changed from a0-18-28-b2-2e-af to 6c-94-f8-43-f4-f9 [ARP rcvd on: lag.0.50] <165>Feb 1 17:26:29 10.0.1.1 RtrArpProc[3]MAC address for 10.10.41.133 has changed from 6c-94-f8-43-f4-f9 to a0-18-28-b2-2e-af [ARP rcvd on: lag.0.50] <165>Feb 1 17:27:49 10.0.1.1 RtrArpProc[3]MAC address for 10.10.41.133 has changed from a0-18-28-b2-2e-af to 6c-94-f8-43-f4-f9 [ARP rcvd on: lag.0.50] <165>Feb 1 17:28:01 10.0.1.1 RtrArpProc[3]MAC address for 10.10.41.133 has changed from 6c-94-f8-43-f4-f9 to a0-18-28-b2-2e-af [ARP rcvd on: lag.0.50] <165>Feb 1 17:29:19 10.0.1.1 RtrArpProc[3]MAC address for 10.10.41.133 has changed from a0-18-28-b2-2e-af to 6c-94-f8-43-f4-f9 [ARP rcvd on: lag.0.50] <165>Feb 1 17:29:48 10.0.1.1 RtrArpProc[3]MAC address for 10.10.41.133 has changed from 6c-94-f8-43-f4-f9 to a0-18-28-b2-2e-af [ARP rcvd on: lag.0.50] <165>Feb 1 17:30:49 10.0.1.1 RtrArpProc[3]MAC address for 10.10.41.133 has changed from a0-18-28-b2-2e-af to 6c-94-f8-43-f4-f9 [ARP rcvd on: lag.0.50] <165>Feb 1 17:31:18 10.0.1.1 RtrArpProc[3]MAC address for 10.10.41.133 has changed from 6c-94-f8-43-f4-f9 to a0-18-28-b2-2e-af [ARP rcvd on: lag.0.50] <165>Feb 1 17:32:19 10.0.1.1 RtrArpProc[3]MAC address for 10.10.41.133 has changed from a0-18-28-b2-2e-af to 6c-94-f8-43-f4-f9 [ARP rcvd on: lag.0.50] <165>Feb 1 17:32:40 10.0.1.1 RtrArpProc[3]MAC address for 10.10.41.133 has changed from 6c-94-f8-43-f4-f9 to a0-18-28-b2-2e-af [ARP rcvd on: lag.0.50] <165>Feb 1 17:33:49 10.0.1.1 RtrArpProc[3]MAC address for 10.10.41.133 has changed from a0-18-28-b2-2e-af to 6c-94-f8-43-f4-f9 [ARP rcvd on: lag.0.50] <165>Feb 1 17:33:57 10.0.1.1 RtrArpProc[3]MAC address for 10.10.41.133 has changed from 6c-94-f8-43-f4-f9 to a0-18-28-b2-2e-af [ARP rcvd on: lag.0.50] <165>Feb 1 17:35:19 10.0.1.1 RtrArpProc[3]MAC address for 10.10.41.133 has changed from a0-18-28-b2-2e-af to 6c-94-f8-43-f4-f9 [ARP rcvd on: lag.0.50] <165>Feb 1 17:35:42 10.0.1.1 RtrArpProc[3]MAC address for 10.10.41.133 has changed from 6c-94-f8-43-f4-f9 to a0-18-28-b2-2e-af [ARP rcvd on: lag.0.50] <165>Feb 1 17:36:23 10.0.1.1 RtrArpProc[3]MAC address for 10.10.41.133 has changed from a0-18-28-b2-2e-af to 6c-94-f8-43-f4-f9 [ARP rcvd on: lag.0.50] <165>Feb 1 17:36:41 10.0.1.1 RtrArpProc[3]MAC address for 10.10.41.133 has changed from 6c-94-f8-43-f4-f9 to a0-18-28-b2-2e-af [ARP rcvd on: lag.0.50] <165>Feb 1 17:37:07 10.0.1.1 RtrArpProc[3]MAC address for 10.10.41.133 has changed from a0-18-28-b2-2e-af to 6c-94-f8-43-f4-f9 [ARP rcvd on: lag.0.50] <165>Feb 1 17:37:18 10.0.1.1 RtrArpProc[3]MAC address for 10.10.41.133 has changed from 6c-94-f8-43-f4-f9 to a0-18-28-b2-2e-af [ARP rcvd on: lag.0.50] <165>Feb 1 17:37:53 10.0.1.1 RtrArpProc[3]MAC address for 10.10.41.133 has changed from a0-18-28-b2-2e-af to 6c-94-f8-43-f4-f9 [ARP rcvd on: lag.0.50] <165>Feb 1 17:38:11 10.0.1.1 RtrArpProc[3]MAC address for 10.10.41.133 has changed from 6c-94-f8-43-f4-f9 to a0-18-28-b2-2e-af [ARP rcvd on: lag.0.50] <165>Feb 1 17:38:15 10.0.1.1 RtrArpProc[3]MAC address for 10.10.41.133 has changed from a0-18-28-b2-2e-af to 6c-94-f8-43-f4-f9 [ARP rcvd on: lag.0.50] <165>Feb 1 17:38:48 10.0.1.1 RtrArpProc[3]MAC address for 10.10.41.133 has changed from 6c-94-f8-43-f4-f9 to a0-18-28-b2-2e-af [ARP rcvd on: lag.0.50] <165>Feb 1 17:39:23 10.0.1.1 RtrArpProc[3]MAC address for 10.10.41.133 has changed from a0-18-28-b2-2e-af to 6c-94-f8-43-f4-f9 [ARP rcvd on: lag.0.50] <165>Feb 1 17:39:59 10.0.1.1 RtrArpProc[3]MAC address for 10.10.41.133 has changed from 6c-94-f8-43-f4-f9 to a0-18-28-b2-2e-af [ARP rcvd on: lag.0.50] <165>Feb 1 17:40:53 10.0.1.1 RtrArpProc[3]MAC address for 10.10.41.133 has changed from a0-18-28-b2-2e-af to 6c-94-f8-43-f4-f9 [ARP rcvd on: lag.0.50] <165>Feb 1 17:41:48 10.0.1.1 RtrArpProc[3]MAC address for 10.10.41.133 has changed from 6c-94-f8-43-f4-f9 to a0-18-28-b2-2e-af [ARP rcvd on: lag.0.50] <165>Feb 1 17:42:23 10.0.1.1 RtrArpProc[3]MAC address for 10.10.41.133 has changed from a0-18-28-b2-2e-af to 6c-94-f8-43-f4-f9 [ARP rcvd on: lag.0.50] <165>Feb 1 17:43:18 10.0.1.1 RtrArpProc[3]MAC address for 10.10.41.133 has changed from 6c-94-f8-43-f4-f9 to a0-18-28-b2-2e-af [ARP rcvd on: lag.0.50] <165>Feb 1 17:43:53 10.0.1.1 RtrArpProc[3]MAC address for 10.10.41.133 has changed from a0-18-28-b2-2e-af to 6c-94-f8-43-f4-f9 [ARP rcvd on: lag.0.50] <165>Feb 1 17:44:04 10.0.1.1 RtrArpProc[3]MAC address for 10.10.41.133 has changed from 6c-94-f8-43-f4-f9 to a0-18-28-b2-2e-af [ARP rcvd on: lag.0.50] <165>Feb 1 17:45:01 10.0.1.1 RtrArpProc[3]MAC address for 10.10.41.133 has changed from a0-18-28-b2-2e-af to 6c-94-f8-43-f4-f9 [ARP rcvd on: lag.0.50]

[Jeremy_Gibbs]

2 Different users in NAC, connecting from two different locations on wireless.

[James_A]

You could be seeing Bonjour Sleep Proxy taking over the IP address. "Computers running Mac OS X Snow Leopard act as a Bonjour sleep proxy server when Internet sharing is enabled."

[Jeremy_Gibbs]

I doubt it. Looking at them in NAC, one is an iPhone iPad etc. ther other I think is a MBP. We don't assign static ips, we would make a dhcp reservation for it. There are also a lot more of these messages. 205,000 + in the last few months. Also, no rogue dhcp servers.

[Joseph_Burnswor]

I would think that one device has a static address and one is getting DHCP

Doing a mac address lookup, they are both Apple Devices. Would you happen to have any Apple TV's on the same subnet and statically assigned?

[Jeremy_Gibbs]

That is what I am thinking. But how and why!!? I don't manage DHCP so this is out of my hands.