locked
ARP answer from wrong client with wrong MAC address RRS feed

  • Question

  • Hi everybody,

    since friday we have a strange problem with some clients and ARP answers. We notice that our switch recognize wrong MAC addresses on some ports.

    We use wireshark to see what happens and we get the following:

    5 clients:

    1. 172.30.71.6 (XX:XX:XX:F7:52:75)
    2. 172.30.41.1 (XX:XX:XX:38:d1:a8)
    3. 172.30.63.1 (XX:XX:XX:c2:b0:b9)
    4. 172.30.14.1 (XX:XX:XX:88:c7:4f)
    5. 172.30.59.1 (XX:XX:XX:7b:67:4d)

    Wireshark runs on client 1 (172.30.71.6, promiscuous mod off)

    Client 5 (172.30.59.1) send a broadcast arp question (who has 172.30.41.1 - tell 172.30.59.1) and client 1 (172.30.71.6) is sending ARP replies with src = XX:XX:XX: 38:d1:a8.

    172.30.41.1 (XX:XX:XX:38:d1:a8) is offline (network cable removed) and 172.30.71.6 has no entry of 172.30.41.1 (XX:XX:XX:38:d1:a8) in his arp cache.

    The clients run Windows 7, Windows 8 and Windows 8.1

    Why we get these phenomenon and how can we solve it? Is there maybe a problem with some updates of the last patchday? 

    Thanks for the reply and kind regards

    Bernd

    Wednesday, September 16, 2015 5:58 AM

Answers

  • It seems that Bonjour creates these ARP answers. I deinstall it and since them it looks good.
    • Proposed as answer by Charles_Wang_ Thursday, September 17, 2015 6:37 AM
    • Marked as answer by Bruce Wooding Wednesday, September 23, 2015 10:19 PM
    Wednesday, September 16, 2015 9:19 AM

All replies

  • Have you cleaned arp cache yet?

    M.

    Wednesday, September 16, 2015 8:12 AM
  • Yes of course. 

    It is only a example - it happens with different clients.

    • Edited by srkonus Wednesday, September 16, 2015 8:24 AM
    Wednesday, September 16, 2015 8:20 AM
  • It seems that Bonjour creates these ARP answers. I deinstall it and since them it looks good.
    • Proposed as answer by Charles_Wang_ Thursday, September 17, 2015 6:37 AM
    • Marked as answer by Bruce Wooding Wednesday, September 23, 2015 10:19 PM
    Wednesday, September 16, 2015 9:19 AM