Junos OS

Dears,

 

We are receiving a huge KERN_ARP_ADDR_CHANGE messages per day , did someone face this issue before ?

 

May 11 18:34:27.752 2016 ALG-KOU-PE-MX960-01-re0 /kernel: %KERN-6-KERN_ARP_ADDR_CHANGE: arp info overwritten for 172.16.16.212 from 00:0f:bb:02:f8:21 to 00:0f:bb:02:f8:20
May 11 18:34:28.751 2016 ALG-KOU-PE-MX960-01-re0 /kernel: %KERN-6-KERN_ARP_ADDR_CHANGE: arp info overwritten for 172.16.16.212 from 00:0f:bb:02:f8:20 to 00:0f:bb:02:f8:21
May 11 18:34:30.151 2016 ALG-KOU-PE-MX960-01-re0 /kernel: %KERN-6-KERN_ARP_ADDR_CHANGE: arp info overwritten for 172.16.16.212 from 00:0f:bb:02:f8:21 to 00:0f:bb:02:f8:20
May 11 18:34:31.151 2016 ALG-KOU-PE-MX960-01-re0 /kernel: %KERN-6-KERN_ARP_ADDR_CHANGE: arp info overwritten for 172.16.16.212 from 00:0f:bb:02:f8:20 to 00:0f:bb:02:f8:21

 

Thank you.

 

BR/

Zakour

This is basically saying that the device configured with 172.16.16.212 is changing mac addresses.  This could be two devices accidently configured with the same address fighting for control.

 

Or this will be a shared ip address on an HA setup or VRRP type device.  Since the mac is switching frequently this probably means there is some kind of configuration or HA heartbeat issue.

hi all

The following log messages happening persistently, never stop! There is a KB -https://kb.juniper.net/InfoCenter/index?page=content&id=KB33414&cat=SRX_5400&actp=LIST&showDraft=false but it related to SRX platform.

Any idea why this is happening and what resolution should be taken to address to this log messages?
Only one RE located on the device.

 

KERN_ARP_ADDR_CHANGE: arp info overwritten for 10.10.240.37 from 00:50:16:8b:06:f2 to 00:50:16:8a:09:a2
KERN_ARP_ADDR_CHANGE: arp info overwritten for 10.10.240.38 from 00:50:16:8b:06:f2 to 00:50:16:8a:09:a2
KERN_ARP_ADDR_CHANGE: arp info overwritten for 10.10.240.37 from 00:50:16:8a:09:a2 to 00:50:16:8b:06:f2
KERN_ARP_ADDR_CHANGE: arp info overwritten for 10.10.240.38 from 00:50:16:8a:09:a2 to 00:50:16:8b:06:f2
KERN_ARP_ADDR_CHANGE: arp info overwritten for 10.10.240.37 from 00:50:16:8a:09:a2 to 00:50:16:8b:06:f2
KERN_ARP_ADDR_CHANGE: arp info overwritten for 10.10.240.38 from 00:50:16:8a:09:a2 to 00:50:16:8b:06:f2

9200EX> show arp | match 10.10.240.37
00:50:16:8b:06:f2      10.10.240.37        10.10.240.37        irb.14 [lsi.1057472]       none

9200EX> show arp | match 10.10.240.38
00:50:16:8a:09:a2      10.10.240.38        10.10.240.38        irb.14 [lsi.1057472]       none

Some thoughts .

This is observed in GARP use cases where you have redundency configured and multiple devices sharing same ip addresses but different MAC.

And you might have DHCP assigning IPs to those and you are receving GARP on both the routers from DHCP.

You can check from which interfaces the MAC is learned for 10.10.240.37 and 10.10.240.38.

Might be you have irb 14 is configured in one more router with same IP .

You can shut one and check whether you are observing this .

KERN_ARP_ADDR_CHANGE: arp info overwritten for 10.10.240.37 from 00:50:16:8b:06:f2 to 00:50:16:8a:09:a2
KERN_ARP_ADDR_CHANGE: arp info overwritten for 10.10.240.38 from 00:50:16:8b:06:f2 to 00:50:16:8a:09:a2

 

The key to seeing why this is occuring will be know what is configured on these two ip addresses and on what type of device.

10.10.240.37

10.10.240.38

 

For throubleshooting, the following didn't give me enough thing to see what happens with this two ip addresses...

 

1-) >sh arp | match  <ip address> ------>to get mac address

2-) >sh ethernet-switching table | match <mac address> -----> to get associated interface on the switch. but this is only showing irb interface not physical interface. So it didn't help further...

3-) >sh route forwarding-table destination <ip address> -----> this showed that its associated L3 vlan interface -irb which sits on the same ex switch...

4-) >monitor traffic interface irb.xx matching "host <ipaddress>" no-resolve size 7000---->this nothing showed.

5-) After 4th step, accedently typing https://<Ip address> on my windows machine ---->a website came up and showed somehting relating to video conferanse and prompting username/password.  Strangely both ip addresses showed the same website. So it can be understood 2 different Ip addresses are for only one facility!

 

Still the case is not visible but one of the key points is why we can not see which physical interface is associated to?

What do you think this troublehooting is correct or not, if not, what should be taken?

 

any help?

Hello, if you are still noticing this problem, then opening up JTAC case would be best thing to proceed on this. 

Hi everyone,

 

i am seeing the same errors on my SRX devices, can somebody confirm if this can cause impact to the overall performace to the link itself

bbsrinivasan, Not as such but one should look into why arp address entries are changing as it consumes system resources unnecessarily.

Thank you msheikoh

 

Seems like the checkpoint firewall configured in HA connecting the interface where arp is being learnt is causing issues. 

Hi Arix,

 

Que :- Still the case is not visible but one of the key points is why we can not see which physical interface is associated to?

 

Juniper:- "show arp" shows the same learnt on irb.14. What are the interfaces connected ?? The 2 ip's are learnt from interfaces part of the said irb.