[nzlug] mac address / arp issues?

[Antonio Broughton]

Hi,

We have a customer that has an IPCop machine that serves their internet,
and a CentOS machine that acts as the windows domain for a number of
workstations.

Starting from Tuesday, there has been issues in regard to the ARP table
on the default gateway for the network (IPCop machine).

The issue that is occuring, is that the windows workstations appear to
loose their internet connection, however, if you go on the IPCop box,
and issue an "arp -a", the following is outputted:

 ? (10.1.5.218) at 00:11:d8:b7:20:36 [ether] on eth0
 ? (10.1.5.219) at 00:11:d8:b7:20:36 [ether] on eth0
 ? (10.1.5.220) at 00:11:d8:b7:20:36 [ether] on eth0
 ? (10.1.5.221) at 00:11:d8:b7:20:36 [ether] on eth0
 ? (10.1.5.222) at 00:11:d8:b7:20:36 [ether] on eth0

If I then goto the client machine, and reboot it, after a couple of
minutes, the arp table slowly goes back to normal, in that the real MAC
addresses now show, and everything works again.

To verify things, 00:11:d8:b7:20:36 is a windows xp computer.

Also, this is not an IPCop issue, as when I modified the clients to use
the CentOS machine as the gateway (and set CentOS to forward packets
onto IPCop), the same thing happened, but on the CentOS

Just wondering if anyone would know why the arp table ends up like this?

The only way to fix the machines, is to reboot the offending windows
computer that causes this... (it is not allways the same computer...)

There is no (as far as im aware) arpproxy server running on the windows
machines.

Would a faulty switch cause issues like this? I have never come accross
this issue before, so any help would be appreciated

Thanks
Antonio Broughton