problem in arp update

[Tapas Jha]

Hi,

I have one hp-ux system which was offline for quite sometime and after that when
i have tried to powered on then we have found that it is not coming to network.
From console we didn't find anything wrong. Everything seems ok. Then from netfmt
command i found that some system is trying to access 199.40.47.9 with different station
address.(00-00-81-09-e2-e8)


Now, we are not finding which system is causing problem whose mac address is specified
other than hp-ux servers mac address. From lanscan it is 00:30:6e:06:e6:e7(hp-ux server)
Even we run network view tools but not getting any machines whose mac address is 00-00-81-09-e2-e8.

From workstation pc also arp is showing physical address of 199.40.47.9 is 00-00-81-09-e2-e8.
Then i remove arp entry for 199.40.47.9 and add arp -s 199.40.47.9 00:30:6e:06:e6:e7. Then ping
199.40.47.9 and found correct arp entry and able to log in. I have done for all the hp-ux servers
which we have(Doing the same procedure since arp table entry was wrong one as above).

But it is not possible to do the same for all the users pc(almost 250 users). Even after doing it
if i reboot the workstation(pc) then try to telnet you will get the the wrong arp entry which
is causing problem. This is the main concern. Somehow it is taking wrong arp entry for 199.40.47.9
and updating arp table. How come i solve this problem? How do i know which is the system whose
mac address is 00-00-81-09-e2-e8.
Even i have noticed one thing from pc , if you remove the arp entry, ping 199.40.47.9 (it will
reply only once and then request timed out) and then observe that arp entry is the wrong one.

Can anybody light up on the solution for this problem?

Thanx in advance.

Tapas

[Robert-Jan Goossens]

Hi Tapas,

are you shore there is no config file somewhere in the HPUX server with an old mac address ?

try a grep "00-00-81-09-e2-e8" /etc/rc.config.d/*

Hope this helps,
Robert-Jan

[Tapas Jha]

Hi Robert,

Thanx for reply.
Mac address is not written in /etc/rc.config.d/* files. I think mac address is written /dev/kmem and /stand/vmunix.

In anyway nothing is there in /etc/rc.config.d/* for old mac address.

I am still waiting for solution from itrc.
:))

Rgds
Tapas

[Ron Kinner · Accepted solution]

IF all the PCs are getting the same entry in their ARP table then there is a device with the same IP address somewhere on the network. You need to find it.

Usually you can go into the switch's forwarding table and find the port where the evil MAC is coming from.

If all else fails then you come in one night and start a ping -t to the 199.40.47.9 and start removing cables from the switch one at a time until the ping stops responding.

Your other alternative is to give the HP a new unused IP address.

Ron

[Tapas Jha]

Hi Ron,

Thanx for your reply. Seems it will help me. The last one also i thought if i could not search for evil device.

Rgds
Tapas