SRX Services Gateway
SRX Services Gateway

Juniper IDS reporting 'ARP HW Changed For IP'

11.02.11   |  
‎11-02-2011 11:41 PM

Juniper IDS reports the below message ....What does this message mean

"No Alert","Unflagged","","0.0.0.0","","0.0.0.0","Accepted","IP","0","","0.0.0.0","0.0.0.0","","Traffic","ARP HW Changed For IP","Info","MYDNSSERVER",""
"No Alert","Unflagged","","0.0.0.0","","mydnsserver","Accepted","IP","0","","0.0.0.0","0.0.0.0","","Traffic","ARP HW Changed For IP","Info","MYDNSSERVER","

Note:IP address for the DNS servers is static.MYDNSSERVER is a DNS server on the Network

2 REPLIES
SRX Services Gateway

Re: Juniper IDS reporting 'ARP HW Changed For IP'

11.03.11   |  
‎11-03-2011 11:37 AM

Hi

 

In the case of the standalone IDP sensor in transparent mode, I seen this message

when arp requests/replies were seen for the known IP on a different interface.

In our case this was caused by a bit lame lab design. To understand what causes

the messages in your case, I think config and a network schema is needed.

Best Regards,
PK

Juniper Ambassador, Juniper Networks Certified Instructor,
JNCIE-SEC #98, JNCIE-ENT #393, JNCIE-SP #2253
[Juniper Authorized Education & Support in Russia]
SRX Services Gateway

Re: Juniper IDS reporting 'ARP HW Changed For IP'

11.04.11   |  
‎11-04-2011 12:09 AM

Hi Peter,

 

Thank you for the reply Not sure whether standalone IDP sensor in transparent mode. I will verify this.

 

This IP is configured only on one interface of the DNS server. Is this a GARP message??

 

Thank you