1. Home
  2. Cisco Systems
  3. Ghost MAC addresses

Ghost MAC addresses

I'm seeing some odd ARP broadcasts on my network:

11:22:28.215534 00:0c:76:4e:04:c8 > Broadcast, ethertype ARP (0x0806), length 60: arp who-has 172.16.100.103 (Broadcast) tell 172.16.100.103

(Why would 172.16.100.103 be asking other machines who has

172.16.100.103 and then tell 172.16.100.103 ??? Doesn't make a lot of sense :-) )

I'm trying to use sh mac-address-table on my 2970s to track down where this address is, but...

2970_1#sh mac-address-table address 000c.764e.04c8 Mac Address Table

-------------------------------------------

Vlan Mac Address Type Ports

---- ----------- -------- ----- 3 000c.764e.04c8 DYNAMIC Gi0/4 Total Mac Addresses for this criterion: 1

2970_1#sh mac-address-table address 000c.764e.04c8 Mac Address Table

-------------------------------------------

Vlan Mac Address Type Ports

---- ----------- -------- ----- 3 000c.764e.04c8 DYNAMIC Gi0/24 Total Mac Addresses for this criterion: 1

2970_1#sh mac-address-table address 000c.764e.04c8 Mac Address Table

-------------------------------------------

Vlan Mac Address Type Ports

---- ----------- -------- ----- 3 000c.764e.04c8 DYNAMIC Gi0/4 Total Mac Addresses for this criterion: 1

2970_1#sh mac-address-table address 000c.764e.04c8 Mac Address Table

-------------------------------------------

Vlan Mac Address Type Ports

---- ----------- -------- ----- 3 000c.764e.04c8 DYNAMIC Gi0/4 Total Mac Addresses for this criterion: 1

2970_1#sh mac-address-table address 000c.764e.04c8 Mac Address Table

-------------------------------------------

Vlan Mac Address Type Ports

---- ----------- -------- ----- 3 000c.764e.04c8 DYNAMIC Gi0/24 Total Mac Addresses for this criterion: 1

Gi0/24 is a trunk to 2970_2 and Gi0/4 is a trunk to 2970_3

Why the fsck is this address dancing around my network? 000c.764e.04c8 is MSI, and I don't have no stinkin' MSI crap in my cage :-) There's a PIX firewall between me and the world, and the only possibility of "extra" traffic getting in might be through the crossconnects between the two cabinets, but that's all they are... crossconnects. I thought maybe they went to a switch or something, but no... they're physical cables.

Reply to
John Oliver
Loading thread data ...

That's standard for machines double-checking that no-one else has been assigned their IP address. Happens especially on Windows machines when the interface is configured (reconfigured or restart). This is not Windows specific, though: it is a common technique.

Reply to
Walter Roberson

The ARP is normal and is I think now required or recommended behaviour. The device is doing a duplicate address check.

Hello am I out there?

If there is a reply then that would be an indication that there was a duplicate address and the IP stack is not supposed to come up.

As to the other thing, I am not sure.

First of all check on the other switches to see if you get a more helpful result.

That will take a few minutes and you may pin it down right away.

There are a couple of explanations. Some servers now have two NICs for resilience, this can with some configurations result in the same MAC appearing from two server ports.

You may have some sort of network loop?

Check for other MACs doing the same thing. 4500s log such events, don't know about 2970. Have a look at the logging levels and in the logs.

logging buffered deb logg buff 60000 debugging service timestamps debug datetime localtime show-timezone service timestamps log datetime localtime show-timezone

sh logg

Reply to
anybody43

Yup. The official term for it is 'gratuitous ARP', if the OP wants to know more.

Regards,

Marco.

Reply to
M.C. van den Bovenkamp

Cabling-Design.com Forums website is not affiliated with any of the manufacturers or service providers discussed here. All logos and trade names are the property of their respective owners.