Junos
Junos

KERN_ARP_ADDR_CHANGE: arp info overwritten

‎05-11-2016 11:08 AM

Dears,

 

We are receiving a huge KERN_ARP_ADDR_CHANGE messages per day , did someone face this issue before ?

 

May 11 18:34:27.752 2016 ALG-KOU-PE-MX960-01-re0 /kernel: %KERN-6-KERN_ARP_ADDR_CHANGE: arp info overwritten for 172.16.16.212 from 00:0f:bb:02:f8:21 to 00:0f:bb:02:f8:20
May 11 18:34:28.751 2016 ALG-KOU-PE-MX960-01-re0 /kernel: %KERN-6-KERN_ARP_ADDR_CHANGE: arp info overwritten for 172.16.16.212 from 00:0f:bb:02:f8:20 to 00:0f:bb:02:f8:21
May 11 18:34:30.151 2016 ALG-KOU-PE-MX960-01-re0 /kernel: %KERN-6-KERN_ARP_ADDR_CHANGE: arp info overwritten for 172.16.16.212 from 00:0f:bb:02:f8:21 to 00:0f:bb:02:f8:20
May 11 18:34:31.151 2016 ALG-KOU-PE-MX960-01-re0 /kernel: %KERN-6-KERN_ARP_ADDR_CHANGE: arp info overwritten for 172.16.16.212 from 00:0f:bb:02:f8:20 to 00:0f:bb:02:f8:21

 

Thank you.

 

BR/

Zakour

JNCIS-SP
7 REPLIES 7
Junos

Re: KERN_ARP_ADDR_CHANGE: arp info overwritten

‎05-11-2016 03:31 PM

This is basically saying that the device configured with 172.16.16.212 is changing mac addresses.  This could be two devices accidently configured with the same address fighting for control.

 

Or this will be a shared ip address on an HA setup or VRRP type device.  Since the mac is switching frequently this probably means there is some kind of configuration or HA heartbeat issue.

Steve Puluka BSEET - Juniper Ambassador
IP Architect - DQE Communications Pittsburgh, PA (Metro Ethernet & ISP)
http://puluka.com/home
Junos

Re: KERN_ARP_ADDR_CHANGE: arp info overwritten

a month ago

hi all

The following log messages happening persistently, never stop! There is a KB -https://kb.juniper.net/InfoCenter/index?page=content&id=KB33414&cat=SRX_5400&actp=LIST&showDraft=fal... but it related to SRX platform.

Any idea why this is happening and what resolution should be taken to address to this log messages?
Only one RE located on the device.

 

KERN_ARP_ADDR_CHANGE: arp info overwritten for 10.10.240.37 from 00:50:16:8b:06:f2 to 00:50:16:8a:09:a2
KERN_ARP_ADDR_CHANGE: arp info overwritten for 10.10.240.38 from 00:50:16:8b:06:f2 to 00:50:16:8a:09:a2
KERN_ARP_ADDR_CHANGE: arp info overwritten for 10.10.240.37 from 00:50:16:8a:09:a2 to 00:50:16:8b:06:f2
KERN_ARP_ADDR_CHANGE: arp info overwritten for 10.10.240.38 from 00:50:16:8a:09:a2 to 00:50:16:8b:06:f2
KERN_ARP_ADDR_CHANGE: arp info overwritten for 10.10.240.37 from 00:50:16:8a:09:a2 to 00:50:16:8b:06:f2
KERN_ARP_ADDR_CHANGE: arp info overwritten for 10.10.240.38 from 00:50:16:8a:09:a2 to 00:50:16:8b:06:f2


9200EX> show arp | match 10.10.240.37
00:50:16:8b:06:f2      10.10.240.37        10.10.240.37        irb.14 [lsi.1057472]       none

9200EX> show arp | match 10.10.240.38
00:50:16:8a:09:a2      10.10.240.38        10.10.240.38        irb.14 [lsi.1057472]       none

Junos

Re: KERN_ARP_ADDR_CHANGE: arp info overwritten

a month ago

Some thoughts .

This is observed in GARP use cases where you have redundency configured and multiple devices sharing same ip addresses but different MAC.

And you might have DHCP assigning IPs to those and you are receving GARP on both the routers from DHCP.

You can check from which interfaces the MAC is learned for 10.10.240.37 and 10.10.240.38.

Might be you have irb 14 is configured in one more router with same IP .

You can shut one and check whether you are observing this .

Junos

Re: KERN_ARP_ADDR_CHANGE: arp info overwritten

a month ago

KERN_ARP_ADDR_CHANGE: arp info overwritten for 10.10.240.37 from 00:50:16:8b:06:f2 to 00:50:16:8a:09:a2
KERN_ARP_ADDR_CHANGE: arp info overwritten for 10.10.240.38 from 00:50:16:8b:06:f2 to 00:50:16:8a:09:a2

 

The key to seeing why this is occuring will be know what is configured on these two ip addresses and on what type of device.

10.10.240.37

10.10.240.38

 

Steve Puluka BSEET - Juniper Ambassador
IP Architect - DQE Communications Pittsburgh, PA (Metro Ethernet & ISP)
http://puluka.com/home
Junos

Re: KERN_ARP_ADDR_CHANGE: arp info overwritten

[ Edited ]
4 weeks ago

For throubleshooting, the following didn't give me enough thing to see what happens with this two ip addresses...

 

1-) >sh arp | match  <ip address> ------>to get mac address

2-) >sh ethernet-switching table | match <mac address> -----> to get associated interface on the switch. but this is only showing irb interface not physical interface. So it didn't help further...

3-) >sh route forwarding-table destination <ip address> -----> this showed that its associated L3 vlan interface -irb which sits on the same ex switch...

4-) >monitor traffic interface irb.xx matching "host <ipaddress>" no-resolve size 7000---->this nothing showed.

5-) After 4th step, accedently typing https://<Ip address> on my windows machine ---->a website came up and showed somehting relating to video conferanse and prompting username/password.  Strangely both ip addresses showed the same website. So it can be understood 2 different Ip addresses are for only one facility!

 

Still the case is not visible but one of the key points is why we can not see which physical interface is associated to?

What do you think this troublehooting is correct or not, if not, what should be taken?

 

Junos

Re: KERN_ARP_ADDR_CHANGE: arp info overwritten

4 weeks ago

any help?

Junos

Re: KERN_ARP_ADDR_CHANGE: arp info overwritten

4 weeks ago

Hi Arix,

 

Que :- Still the case is not visible but one of the key points is why we can not see which physical interface is associated to?

 

Juniper:- "show arp" shows the same learnt on irb.14. What are the interfaces connected ?? The 2 ip's are learnt from interfaces part of the said irb.

Regards,
Rahul