[ale] Slightly OT: Decyphering 'arp' error

[John Mills]

Mike, Tim -

Thanks for the help.

On Wed, 22 Oct 2008, Michael H. Warfield wrote:

> On Wed, 2008-10-22 at 10:03 -0400, John Mills wrote:

>> I have a network device that requests a DHCP address assignment on boot.
>> It expects and receives a particular address in our subnet. Shortly after,
>> it presents the following warning on the system log:

>>   "arp: 0xc04ac1b4 is using my IP address 172.16.1.160!"

> 	0xc04ac1b4 would be the MAC address of the offending device.

> 	00:00:c0:4a:c1:b4

As to the identifier '0xc04ac1b4', I'm still a bit in the dark. The actual 
MAC of the interloper was: '00:16:5d:20:00:86' -- not any obvious match 
to me, but clearly in the series of our products.

> 	Have you run a ping against that address with your network device off?
> Do you get a host unreachable?  What do you get when you dump the arp
> tables (arp -a) after that?  What's the MAC address of your device?

I turned my device off and sure enough, a PING to that IP was still 
answered.

I then tried for a web page and indeed the unit was one of our test 
critters, similar model to my own. That gave me the identity and basic 
control. I rebooted the 'stranger' and it was awarded a new, different IP 
when it came back. My assigned address was then fine.

  ...
> 	It sounds like it's offering the correct address to your device and
> then your device doesn't like it when it tries to configure the address.
> I'm inclined to believe that means someone put a static configured
> device on the network.  I don't even think MS DHCP is that broken that
> it would hand out an address to a machine when it has already allocated
> it, static or otherwise.  ISC dhcpd will first ping and address and
> abandon it in the logs for dynamic assignment and never offer it, but it
> sounds like you do have a static assignment.

It's possible someone set up the interloper with a static IP -- in fact we 
got a note about that problem from our sysadmin just the day before. &8^)

Thanks again for the input. I learned from the comments and the event.

  - Mills