# arp problem in /var/log/messages



## parcival (Apr 26, 2010)

hi all, i got a lot msgs like 100+ lines, any idea?
my kernel is FreeBSD 8.0-RELEASE-p2


```
+++ /tmp/security.oE7cPuZd	2010-04-26 03:01:45.000000000 +0200
+arp: 192.168.100.155 moved from 00:50:56:b5:79:85 to 00:50:56:b5:08:38 on em0
+arp: 192.168.100.155 moved from 00:50:56:b5:79:85 to 00:50:56:b5:08:38 on em0
+arp: 192.168.100.155 moved from 00:50:56:b5:79:85 to 00:50:56:b5:08:38 on em0
```

192.168.100.155 is a DNS server (linux) with two NICs (internal / external view),
both NICs in the same subnet / braodcast domain.
Both servers are virtualized (VMWare ESX4).

Everything works without problems. Me surprises only these arp messages.
Does FreeBSD have problems with the virtual Switch VMWare?

Thanks for each assistance.

parcival


----------



## SirDice (Apr 26, 2010)

parcival said:
			
		

> 192.168.100.155 is a DNS server (linux) with two NICs (internal / external view), both NICs in the same subnet / braodcast domain.


This is your problem. It's sending data on both interfaces thus moving the IP address from one interface to another (and consequently from one MAC address to another).


----------



## parcival (Apr 26, 2010)

SireDice, thanks for your fast answer.
Can you explain please somewhat more exactly?
What do you mean with send to both NICs? (braodcast ?)

In the resolve.conf (FreeBSD) there is only this entry

nameserver	192.168.100.155 -> internal view

It gives here still another few linux server, which does not have these arp message.

What can i do (FreeBSD)?

thx


----------



## SirDice (Apr 26, 2010)

parcival said:
			
		

> Can you explain please somewhat more exactly?
> What do you mean with send to both NICs? (braodcast ?)


Both interfaces are on the same subnet. When data comes in, gets processed and sent out, the system has no idea which of the two interfaces the original request came in on. Most likely it will send the data out in a round-robin fashion. InterfaceA, interfaceB, interfaceA, interfaceB etc. When that happens the source MAC address changes, the data get's sent out a different interface. This is what arp is telling you. It detected a source IPaddrA with source MACaddrB instead of MACaddrA.



> What can i do (FreeBSD)?


Nothing, because the 'problem' isn't on your FreeBSD box.


----------



## parcival (Apr 26, 2010)

SireDice, thanks for the good explanation.
Then the question arises, how i make at the best with the DNS server?
I remove the second NIC and provide one IP alias on the first NIC.

thx


----------

