2

While looking for duplicate addresses with the following command, "arp-scan --timeout 1000 192.168.110.0/24", I discovered that the host I'm running this command on has multiple MAC addresses for the same IP address.

192.168.110.200 00:90:e8:64:0f:a7       MOXA TECHNOLOGIES CORP., LTD.
192.168.110.200 00:90:e8:64:0f:a9       MOXA TECHNOLOGIES CORP., LTD. (DUP: 2)
192.168.110.200 00:90:e8:64:0f:a5       MOXA TECHNOLOGIES CORP., LTD. (DUP: 3)
192.168.110.200 00:90:e8:64:0f:ab       MOXA TECHNOLOGIES CORP., LTD. (DUP: 4)
192.168.110.200 00:90:e8:64:0f:9b       MOXA TECHNOLOGIES CORP., LTD. (DUP: 5)
192.168.110.200 00:90:e8:64:0f:af       MOXA TECHNOLOGIES CORP., LTD. (DUP: 6)

Note that 192.168.110.200 is the Linux host from which I am running the command. Additionally, I have 35 other cloned hosts that are in identical isolated networks and I am not seeing this behaviour.

I am starting to think this is hardware problem.

Improve this question
1
  • 1
    Have you excluded the possibility that there may be in fact other devices configured with the same IP address? Moxa Technologies makes various industrial automation devices, some of which are quite small. If you're connected to a managed switch, take a look at its MAC address table to see which ports those MACs are detected in. Then follow the cable.
    – telcoM
    Apr 11, 2019 at 6:38

1 Answer 1

Reset to default
1

it seems to me that you are dealing with an ARP flux. If your Linux host has many Ethernet interfaces on the same subnet then your host replies to ARP requests for interfaces on the same subnet, from any interface on that same subnet.

Starting from kernel 2.6.4, the default behavior of the Linux kernel can be corrected with the two following commands:

$ sysctl -w net.ipv4.conf.all.arp_announce=1
$ sysctl -w net.ipv4.conf.all.arp_ignore=2
Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .