topic Duplicate Network Address in Operating System - HP-UX

Duplicate Network Address

joe_91 — Tue, 11 Jun 2002 12:18:36 GMT

Hi

I attached a sniffer to the nclass which gave me the duplicate network address message. The ipadress of the machine seems to communicate to two physical addresses and also a virtual mac adderss. We are running 11.0 with the machine attached to a switch. Also do i need to enter the physical address in /etc/rc.config.d/hppci100conf file? Currently i have not defined any address for the lan cards there.Any help would be appreciated.

Thanks
Joe.

Re: Duplicate Network Address

Duncan Edmonstone — Tue, 11 Jun 2002 12:25:24 GMT

Can you post the outpust of these commands?

lanscan
netstat -in

Thx

Duncan

Re: Duplicate Network Address

PIYUSH D. PATEL — Tue, 11 Jun 2002 12:40:39 GMT

Hi,

Also post the output of the /etc/rc.config.d/netconf file.

Piyush

Re: Duplicate Network Address

joe_91 — Tue, 11 Jun 2002 12:45:36 GMT

Hi;

I have attached them.

Thanks
Joe.

Re: Duplicate Network Address

Duncan Edmonstone — Tue, 11 Jun 2002 12:57:57 GMT

You certainly don't need to assign MAC addresses in the config files in /etc/rc.config.d

As you have no doubt noted from the output of lanscan, you have a total of six network cards in your server, of which at least three (probably four) have network connections. None of the cards have duplicate MAC addresses.

You will note that in the output for lan1 in netstat there are *two* IP addresses bound to the card (this may explain what you are seeing with your sniffer). This is not necessarily a bad thing - in fact it looks rather like this server is a node in a MC/ServiceGuard cluster, where lan1 is the data LAN, and lan4 is the standby LAN, amd lan0 looks like a heartbeat LAN (I'm guessing here).

If this doesn't explain your problem then the first pace I'd look is the other node(s) in the MC/ServiceGuard cluster - check the IP addresses/MAC addresses on those systems too.

HTH

Duncan

Re: Duplicate Network Address

PIYUSH D. PATEL — Tue, 11 Jun 2002 13:00:24 GMT

Hi,

It seems that you have done multiplexing....asigned two IP addresses for your lan1 network card. See the output of your netstat -in...the first two lines.

135.51.27.23 lan1
135.51.27.19 lan1:1 ( logical interface )

# ifconfig -removeif <135.51.27.19>

You can remove the other IP thro SAM also.

Piyush

Re: Duplicate Network Address

joe_91 — Tue, 11 Jun 2002 13:09:33 GMT

Hi:

So you feel i can ignore the messages. Actually when i attach the sniffer it shows apart from the MAC address of the machine two other mac addresses. What are they i do not find it on lanscan. Are they virtual MAC addresses? If so what is the meaning? Thanks once again for all your time.

Thanks
Joe.

Re: Duplicate Network Address

Duncan Edmonstone — Tue, 11 Jun 2002 13:16:22 GMT

I wouldn't be so sure you can ignore this message - what is the exact syntax of the error message, and where did it come from?

Presumably the other MAC addresses are from devices the n-class is communicating with...

HTH

Duncan

Re: Duplicate Network Address

Ron Kinner — Tue, 11 Jun 2002 13:30:24 GMT

Might be interesting to see the different MAC addresses that are assigned to this same IP address. The first few numbers of a MAC show the manufacturer which might be a clue.

If you unplug your HP can you still ping the duplicate IP address (from another PC on the same LAN)? If you can then you really have a problem.

Ron

Re: Duplicate Network Address

Duncan Edmonstone — Tue, 11 Jun 2002 14:05:12 GMT

Roy,

If, as I suspect this server is part of a serviceguard cluster, then he definately *will* still be able to ping the IP address when the lan connection is removed, cos it will fail over to the standby LAN.

Cheers

Duncan

Re: Duplicate Network Address

joe_91 — Tue, 11 Jun 2002 15:47:12 GMT

Hi Duncan:

That is true. This node is a single node service guard mainly for lan failover. Does that have anything to do with this problem?

Thanks
Joe.

Re: Duplicate Network Address

U.SivaKumar_2 — Wed, 12 Jun 2002 04:35:13 GMT

Hi,
What is the output of arp -a in that server ?.
Does it shows any unresolved MAC addresses ?.
If your arp cache is ok with no unresolved mac
addresses , then you need not worry about anything ?.

regards,
U.SivaKumar

Re: Duplicate Network Address

sven verhaegen — Wed, 12 Jun 2002 11:06:01 GMT

any messages on duplicate mac adresses are important however trivial they might be , there exists no thing like a 'virtual mac address' ,what does exist is multiple IP using the same mac adress if they are either gathered in a APA aggregation (load balancing), then none of the interfaces is visible only the APA aggregate is seen as interface and the MAC of the card with the lowest instance is used as MAC for it , another way of seeing multiple lancards using the same mac is when doing aliasing like you do , that way you have 1 lancard using the same mac address twice , the difference is made on IP level it still gives a unique numbering this way

If your sniffer talks about duplicate mac adresses first check if the mac isn't simply that of lan1 and lan1:1 in your system they are aliassed , that would explain the error swiftly , if not the only way of finding out what is wrong , is clearing the arp cache (arp -d) of the mac adresses that are duplicate and then either wai t for the address to come in the list trough noermal system network trafic and check the IP from which it derives , then clean it and wait seein if the next time th ip is change for the mac address remarked as duplicate ... if the network is limited you can do the same but then actively pinging station after station and looking in arp ahat mac address it has ..

personally I think the sniffer sees the 2 ip's on the same lancard with the same mac number and considers it duplicate , it normally is no problem for routing as all packets will still arrive on the same card and leave from the same card , if you had a real issue then you would be suffereing from abnormal diconnections , telnet timeouts etc... a whole lot of problem on the network which you seem not to have at all