topic Re: MAC address error in syslog file in Operating System - HP-UX

MAC address error in syslog file

john D_3 — Fri, 05 Nov 2004 21:03:35 GMT

Hi,

In my syslog.log file I am getting following error message on daily basis:

unix: WARNING: ARP: got MAC address on ef for BCAST IP address 0.0.0.0

Any body has any idea about it.

Thanks

Re: MAC address error in syslog file

Ron Kinner — Fri, 05 Nov 2004 22:56:47 GMT

Appears there is a misconfigured host on the network. When a host boots it sends out a gratuitous ARP where it tells everyone on the network what its IP address and M.A.C are. This is a conflict resolution trick. If a second machine already has the address then it would protest or at least warn its admin that there was a conflict. (Don't remember exactly what it is supposed to do. Probably spelled out in RFC-826 somewhere) In your case the host is proudly announcing that his IP address is 0.0.0.0 which makes no sense to your HPUX so he logs it as an error.

I have seen a report where everytime a MAC would reboot it would cause this error.

Another said: "It usually means you have a system somewhere on your network that is
ARPing its IP address as the broadcast address for your network. You
want to find the host and fix it."

and again: "This message is not very serious and should not be
affecting the performance of the network. The
error message is reporting that there is a host on your network with its IP address set to network broadcast address. It can be hard to track down the offending host which could be another SGI, another vendors machine or a printer etc."

Could possibly be a machine which simply has no IP address assigned. Maybe DHCP client is broken or somebody forgot to give it an IP address.

Ron

Re: MAC address error in syslog file

Ron Kinner — Fri, 05 Nov 2004 23:03:24 GMT

If you look at the this thread

ifconfig lan0:2 0.0.0.0 up doesn't work

which is about 10 posts below this one. There is a possible answer to how this could happen. In order to remove a virtual IP address the man tells you to change it to 0.0.0.0 but it also appears to forget to tell you to turn the interface down after you do so. Reboot the system and it will happily tell the world that it has IP addres of 0.0.0.0.

Ron