frequent change of mac addresses

THE_KINGDOM · Dec 27, 2014

I have a constant frequent change of MAC addresses very often on the FreeNAS... Any idea why?

SweetAndLow · Dec 27, 2014

How do you know they are changing? Mac address never really change since they are usually unique to the physical network hardware.

Z300M · Dec 28, 2014

THE_KINGDOM said:
I have a constant frequent change of MAC addresses very often on the FreeNAS... Any idea why?

You mean something like the following?

Code:

freenas.XXXXXX kernel log messages:

arp: 192.168.1.XX moved from aa:bb:cc:dd:ee:ff to gg:hh:ii:jj:kk:ll on epair3b
arp: 192.168.1.XX moved from aa:bb:cc:dd:ee:ff to gg:hh:ii:jj:kk:ll on epair3b

-- End of security output --

I get these frequently. I have no idea why.

airflow · Dec 28, 2014

I have the same phenomenon and no idea why.

I tried to understand the issue and also started a forum-thread about this (yesterday, in the networking-section): https://forums.freenas.org/index.php?threads/mac-flipping-when-using-jails.26172/ Have a look, I summarized some of my findings there.

greetings

Ericloewe · Dec 28, 2014

Z300M said:
You mean something like the following?

Code:
freenas.XXXXXX kernel log messages: arp: 192.168.1.XX moved from aa:bb:cc:dd:ee:ff to gg:hh:ii:jj:kk:ll on epair3b arp: 192.168.1.XX moved from aa:bb:cc:dd:ee:ff to gg:hh:ii:jj:kk:ll on epair3b -- End of security output --

I get these frequently. I have no idea why.

Apple devices on the network? If so, that's a common thing:

AirPlay can have other AirPlay servers temporarily take over for devices that want to sleep. They take over the IP address of the sleeping server and accept incoming AirPlay requests, so that they can wake the sleeping server when needed, which then retakes its IP.
It's not strictly best practices, but it seems harmless enough.

Of course, it could also be a good ol' IP conflict.

SweetAndLow · Dec 28, 2014

Ericloewe said:
Apple devices on the network? If so, that's a common thing:

AirPlay can have other AirPlay servers temporarily take over for devices that want to sleep. They take over the IP address of the sleeping server and accept incoming AirPlay requests, so that they can wake the sleeping server when needed, which then retakes its IP.
It's not strictly best practices, but it seems harmless enough.

Of course, it could also be a good ol' IP conflict.

I did not know that about airplay. That is interesting. It looks like an ip conflict to me.

airflow · Dec 28, 2014

SweetAndLow said:
I did not know that about airplay. That is interesting. It looks like an ip conflict to me.

No, these messages are not related to airplay-behaviour. There are no Apple-devices on this network. But interesting information nevertheless, thanks.

Yes, it looks like an IP conflict. But I can also rule that out. The IP the messages are about is always the IP of the main FreeNAS-OS itself. I analysed what devices/MAC adresses are involved exactly (which translates to "who else except my FreeNAS-box is announcing that it holds its IP-adress"). And it's always a move between the MAC of epair<n>a (this is a logical interface which is created automatically by FreeNAS when creating jails) and the real physical interface of the FreeNAS-box (and its MAC). But there is no real conflict, IP traffic is forwarded between FreeNAS and its jails without problems. I explained it in detail here.

THE_KINGDOM · Dec 28, 2014

Same thing here, no apple devices on this network.

And yes it is in the: local security run output

Doesn't make sense. Would love to figure this out

SweetAndLow · Dec 29, 2014

Are you using any kind of nic bonding?

THE_KINGDOM · Dec 29, 2014

SweetAndLow said:
Are you using any kind of nic bonding?

Not that I'm aware of, I think that has to be configured?

SweetAndLow · Dec 29, 2014

Just wanted to double check

cyberjock · Dec 31, 2014

That's an indicator of some kind of IP conflict. The errors are saying that the IP address 192.168.1.xx belonged to aa:bb:cc:dd:ee:ff and it has changed to gg:hh:ii:jj:kk:ll. The reason is for you to figure out. The system is simply reporting abnormal behavior.

Z300M · Dec 31, 2014

cyberjock said:
That's an indicator of some kind of IP conflict. The errors are saying that the IP address 192.168.1.xx belonged to aa:bb:cc:dd:ee:ff and it has changed to gg:hh:ii:jj:kk:ll. The reason is for you to figure out. The system is simply reporting abnormal behavior.

At least on my system gg:hh:ii:jj:kk:ll is the real hardware address of the motherboard LAN port I am using.
If I execute ipconfig, I get (among others):

Code:

epair3a: flags=8943<UP,BROADCAST,RUNNING,PROMISC,SIMPLEX,MULTICAST> metric 0 mtu
1500
options=8<VLAN_MTU>
ether 02:2b:1a:00:0c:0a
nd6 options=1<PERFORMNUD>
media: Ethernet 10Gbase-T (10Gbase-T <full-duplex>)
status: active

where 02:2b:1a:00:0c:0a corresonds to aa:bb:cc:dd:ee:ff in the security run output.

That MAC address appears to be fictitious: the various lookup tools on the 'Net find no vendor information for that MAC address. I do not have any 10Gbase-T hardware.

And note that although the security run output refers to epair3b, the output of ifconfig refers to epair3a. ifconfig shows no references at all to epairXb.

THE_KINGDOM · Jan 3, 2015

so I have looked at the list of MAC addresses on my LAN, the changes happening are from the MAC address dedicated to each jail within the plugins such as: transmission, couch potato, plex etc to the MAC address of the actual FreeNAS on the network.

I have the main IP address of my FreeNAS set to 192.168.0.30, it is switching this IP address from a MAC address from one of the plugins to the main motherboard MAC address of the FreeNAS, saying either: on epair3b, epair2b, epair1b or epair0b

Any idea's?

cyberjock · Jan 3, 2015

THE_KINGDOM said:
so I have looked at the list of MAC addresses on my LAN, the changes happening are from the MAC address dedicated to each jail within the plugins such as: transmission, couch potato, plex etc to the MAC address of the actual FreeNAS on the network.

I have the main IP address of my FreeNAS set to 192.168.0.30, it is switching this IP address from a MAC address from one of the plugins to the main motherboard MAC address of the FreeNAS, saying either: on epair3b, epair2b, epair1b or epair0b

Any idea's?

I don't have any off the top of my head. I do see you have a desktop board and your NIC isn't one of the ones I'm used to encountering, so there could be a problem that is manifesting itself with that chip. I don't know. I don't have the problem you are having so unfortunately all I can say is "works for me".

Can you post the output of ifconfig?

Ericloewe · Jan 3, 2015

Well, the driver for the consumer version of the i217 (LV was it?) isn't officially supported under FreeBSD, so odd quirks may happen.

ggoldfingerd · Nov 22, 2015

What ever happened with this error?

I have a similar issue with the moved from XX:XX:... being each jail MAC address and to XX:XX:... being the motherboard MAC address. I have a Supermicro X8DTE-F motherboard. I've been getting this messages for months and it's finally annoying the hell out of me. I've checked each jail and it does contain it's own unique MAC address.

Error Messages:

Code:

Nov 22 20:51:21 freenas kernel: arp: 192.168.1.5 moved from 02:03:44:00:12:0a to 00:25:90:08:06:ac on epair4b
Nov 22 20:51:21 freenas kernel: arp: 192.168.1.5 moved from 02:82:cb:00:11:0a to 00:25:90:08:06:ac on epair3b
Nov 22 20:51:21 freenas kernel: arp: 192.168.1.5 moved from 02:5b:05:00:10:0a to 00:25:90:08:06:ac on epair2b
Nov 22 20:51:21 freenas kernel: arp: 192.168.1.5 moved from 02:eb:e1:00:0f:0a to 00:25:90:08:06:ac on epair1b
Nov 22 20:51:21 freenas kernel: arp: 192.168.1.5 moved from 02:41:63:00:0e:0a to 00:25:90:08:06:ac on epair0b

ifconfig report:

Code:

em0: flags=8943<UP,BROADCAST,RUNNING,PROMISC,SIMPLEX,MULTICAST> metric 0 mtu 1500
        options=42098<VLAN_MTU,VLAN_HWTAGGING,VLAN_HWCSUM,WOL_MAGIC,VLAN_HWTSO>
        ether 00:25:90:08:06:ac
        inet 192.168.1.5 netmask 0xffffff00 broadcast 192.168.1.255
        nd6 options=9<PERFORMNUD,IFDISABLED>
        media: Ethernet autoselect (1000baseT <full-duplex>)
        status: active
em1: flags=8c02<BROADCAST,OACTIVE,SIMPLEX,MULTICAST> metric 0 mtu 1500
        options=4219b<RXCSUM,TXCSUM,VLAN_MTU,VLAN_HWTAGGING,VLAN_HWCSUM,TSO4,WOL_MAGIC,VLAN_HWTSO>
        ether 00:25:90:08:06:ad
        nd6 options=9<PERFORMNUD,IFDISABLED>
        media: Ethernet autoselect
        status: no carrier
ipfw0: flags=8801<UP,SIMPLEX,MULTICAST> metric 0 mtu 65536
        nd6 options=9<PERFORMNUD,IFDISABLED>
lo0: flags=8049<UP,LOOPBACK,RUNNING,MULTICAST> metric 0 mtu 16384
        options=600003<RXCSUM,TXCSUM,RXCSUM_IPV6,TXCSUM_IPV6>
        inet6 ::1 prefixlen 128
        inet6 fe80::1%lo0 prefixlen 64 scopeid 0xc
        inet 127.0.0.1 netmask 0xff000000
        nd6 options=21<PERFORMNUD,AUTO_LINKLOCAL>
bridge0: flags=8843<UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST> metric 0 mtu 1500
        ether 02:58:01:16:26:00
        nd6 options=1<PERFORMNUD>
        id 00:00:00:00:00:00 priority 32768 hellotime 2 fwddelay 15
        maxage 20 holdcnt 6 proto rstp maxaddr 2000 timeout 1200
        root id 00:00:00:00:00:00 priority 32768 ifcost 0 port 0
        member: epair4a flags=143<LEARNING,DISCOVER,AUTOEDGE,AUTOPTP>
                ifmaxaddr 0 port 18 priority 128 path cost 2000
        member: epair3a flags=143<LEARNING,DISCOVER,AUTOEDGE,AUTOPTP>
                ifmaxaddr 0 port 17 priority 128 path cost 2000
        member: epair2a flags=143<LEARNING,DISCOVER,AUTOEDGE,AUTOPTP>
                ifmaxaddr 0 port 16 priority 128 path cost 2000
        member: epair1a flags=143<LEARNING,DISCOVER,AUTOEDGE,AUTOPTP>
                ifmaxaddr 0 port 15 priority 128 path cost 2000
        member: epair0a flags=143<LEARNING,DISCOVER,AUTOEDGE,AUTOPTP>
                ifmaxaddr 0 port 14 priority 128 path cost 2000
        member: em0 flags=143<LEARNING,DISCOVER,AUTOEDGE,AUTOPTP>
                ifmaxaddr 0 port 5 priority 128 path cost 20000
epair0a: flags=8943<UP,BROADCAST,RUNNING,PROMISC,SIMPLEX,MULTICAST> metric 0 mtu 1500
        options=8<VLAN_MTU>
        ether 02:41:63:00:0e:0a
        nd6 options=1<PERFORMNUD>
        media: Ethernet 10Gbase-T (10Gbase-T <full-duplex>)
        status: active
epair1a: flags=8943<UP,BROADCAST,RUNNING,PROMISC,SIMPLEX,MULTICAST> metric 0 mtu 1500
        options=8<VLAN_MTU>
        ether 02:eb:e1:00:0f:0a
        nd6 options=1<PERFORMNUD>
        media: Ethernet 10Gbase-T (10Gbase-T <full-duplex>)
        status: active
epair2a: flags=8943<UP,BROADCAST,RUNNING,PROMISC,SIMPLEX,MULTICAST> metric 0 mtu 1500
        options=8<VLAN_MTU>
        ether 02:5b:05:00:10:0a
        nd6 options=1<PERFORMNUD>
        media: Ethernet 10Gbase-T (10Gbase-T <full-duplex>)
        status: active
epair3a: flags=8943<UP,BROADCAST,RUNNING,PROMISC,SIMPLEX,MULTICAST> metric 0 mtu 1500
        options=8<VLAN_MTU>
        ether 02:82:cb:00:11:0a
        nd6 options=1<PERFORMNUD>
        media: Ethernet 10Gbase-T (10Gbase-T <full-duplex>)
        status: active
epair4a: flags=8943<UP,BROADCAST,RUNNING,PROMISC,SIMPLEX,MULTICAST> metric 0 mtu 1500
        options=8<VLAN_MTU>
        ether 02:03:44:00:12:0a
        nd6 options=1<PERFORMNUD>
        media: Ethernet 10Gbase-T (10Gbase-T <full-duplex>)
        status: active

Thanks in advance for any help.

anodos · Nov 23, 2015

ggoldfingerd said:

What ever happened with this error?

I have a similar issue with the moved from XX:XX:... being each jail MAC address and to XX:XX:... being the motherboard MAC address. I have a Supermicro X8DTE-F motherboard. I've been getting this messages for months and it's finally annoying the hell out of me. I've checked each jail and it does contain it's own unique MAC address.

Error Messages:

Code:

Nov 22 20:51:21 freenas kernel: arp: 192.168.1.5 moved from 02:03:44:00:12:0a to 00:25:90:08:06:ac on epair4b
Nov 22 20:51:21 freenas kernel: arp: 192.168.1.5 moved from 02:82:cb:00:11:0a to 00:25:90:08:06:ac on epair3b
Nov 22 20:51:21 freenas kernel: arp: 192.168.1.5 moved from 02:5b:05:00:10:0a to 00:25:90:08:06:ac on epair2b
Nov 22 20:51:21 freenas kernel: arp: 192.168.1.5 moved from 02:eb:e1:00:0f:0a to 00:25:90:08:06:ac on epair1b
Nov 22 20:51:21 freenas kernel: arp: 192.168.1.5 moved from 02:41:63:00:0e:0a to 00:25:90:08:06:ac on epair0b

ifconfig report:

Code:

em0: flags=8943<UP,BROADCAST,RUNNING,PROMISC,SIMPLEX,MULTICAST> metric 0 mtu 1500
        options=42098<VLAN_MTU,VLAN_HWTAGGING,VLAN_HWCSUM,WOL_MAGIC,VLAN_HWTSO>
        ether 00:25:90:08:06:ac
        inet 192.168.1.5 netmask 0xffffff00 broadcast 192.168.1.255
        nd6 options=9<PERFORMNUD,IFDISABLED>
        media: Ethernet autoselect (1000baseT <full-duplex>)
        status: active
em1: flags=8c02<BROADCAST,OACTIVE,SIMPLEX,MULTICAST> metric 0 mtu 1500
        options=4219b<RXCSUM,TXCSUM,VLAN_MTU,VLAN_HWTAGGING,VLAN_HWCSUM,TSO4,WOL_MAGIC,VLAN_HWTSO>
        ether 00:25:90:08:06:ad
        nd6 options=9<PERFORMNUD,IFDISABLED>
        media: Ethernet autoselect
        status: no carrier
ipfw0: flags=8801<UP,SIMPLEX,MULTICAST> metric 0 mtu 65536
        nd6 options=9<PERFORMNUD,IFDISABLED>
lo0: flags=8049<UP,LOOPBACK,RUNNING,MULTICAST> metric 0 mtu 16384
        options=600003<RXCSUM,TXCSUM,RXCSUM_IPV6,TXCSUM_IPV6>
        inet6 ::1 prefixlen 128
        inet6 fe80::1%lo0 prefixlen 64 scopeid 0xc
        inet 127.0.0.1 netmask 0xff000000
        nd6 options=21<PERFORMNUD,AUTO_LINKLOCAL>
bridge0: flags=8843<UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST> metric 0 mtu 1500
        ether 02:58:01:16:26:00
        nd6 options=1<PERFORMNUD>
        id 00:00:00:00:00:00 priority 32768 hellotime 2 fwddelay 15
        maxage 20 holdcnt 6 proto rstp maxaddr 2000 timeout 1200
        root id 00:00:00:00:00:00 priority 32768 ifcost 0 port 0
        member: epair4a flags=143<LEARNING,DISCOVER,AUTOEDGE,AUTOPTP>
                ifmaxaddr 0 port 18 priority 128 path cost 2000
        member: epair3a flags=143<LEARNING,DISCOVER,AUTOEDGE,AUTOPTP>
                ifmaxaddr 0 port 17 priority 128 path cost 2000
        member: epair2a flags=143<LEARNING,DISCOVER,AUTOEDGE,AUTOPTP>
                ifmaxaddr 0 port 16 priority 128 path cost 2000
        member: epair1a flags=143<LEARNING,DISCOVER,AUTOEDGE,AUTOPTP>
                ifmaxaddr 0 port 15 priority 128 path cost 2000
        member: epair0a flags=143<LEARNING,DISCOVER,AUTOEDGE,AUTOPTP>
                ifmaxaddr 0 port 14 priority 128 path cost 2000
        member: em0 flags=143<LEARNING,DISCOVER,AUTOEDGE,AUTOPTP>
                ifmaxaddr 0 port 5 priority 128 path cost 20000
epair0a: flags=8943<UP,BROADCAST,RUNNING,PROMISC,SIMPLEX,MULTICAST> metric 0 mtu 1500
        options=8<VLAN_MTU>
        ether 02:41:63:00:0e:0a
        nd6 options=1<PERFORMNUD>
        media: Ethernet 10Gbase-T (10Gbase-T <full-duplex>)
        status: active
epair1a: flags=8943<UP,BROADCAST,RUNNING,PROMISC,SIMPLEX,MULTICAST> metric 0 mtu 1500
        options=8<VLAN_MTU>
        ether 02:eb:e1:00:0f:0a
        nd6 options=1<PERFORMNUD>
        media: Ethernet 10Gbase-T (10Gbase-T <full-duplex>)
        status: active
epair2a: flags=8943<UP,BROADCAST,RUNNING,PROMISC,SIMPLEX,MULTICAST> metric 0 mtu 1500
        options=8<VLAN_MTU>
        ether 02:5b:05:00:10:0a
        nd6 options=1<PERFORMNUD>
        media: Ethernet 10Gbase-T (10Gbase-T <full-duplex>)
        status: active
epair3a: flags=8943<UP,BROADCAST,RUNNING,PROMISC,SIMPLEX,MULTICAST> metric 0 mtu 1500
        options=8<VLAN_MTU>
        ether 02:82:cb:00:11:0a
        nd6 options=1<PERFORMNUD>
        media: Ethernet 10Gbase-T (10Gbase-T <full-duplex>)
        status: active
epair4a: flags=8943<UP,BROADCAST,RUNNING,PROMISC,SIMPLEX,MULTICAST> metric 0 mtu 1500
        options=8<VLAN_MTU>
        ether 02:03:44:00:12:0a
        nd6 options=1<PERFORMNUD>
        media: Ethernet 10Gbase-T (10Gbase-T <full-duplex>)
        status: active

Thanks in advance for any help.

How is networking configured for your jails? Are you using vimage? You mentioned that each jail has a unique mac address. Do they also have unique IP addresses?

ggoldfingerd · Nov 23, 2015

anodos said:
How is networking configured for your jails? Are you using vimage? You mentioned that each jail has a unique mac address. Do they also have unique IP addresses?

My jails and my FreeNAS server are on static IP addresses. Each jail is using vimage. I installed my jails using the Plugins feature of FreeNAS. Yes, each jail has a unique IP address. The rest of my devices on my network use the DHCP server from pfSense. Here is a picture of the advance mode from one jail.

depasseg · Nov 23, 2015

I've been using this solution:
https://forums.freenas.org/index.php?threads/arp-moved-from-mac-to-mac.38647/#post-235222

Important Announcement for the TrueNAS Community.

frequent change of mac addresses

Explorer

Sweet'NASty

Guru

Contributor

Server Wrangler

Sweet'NASty

Contributor

Explorer

Sweet'NASty

Explorer

Sweet'NASty

Inactive Account

Guru

Explorer

Inactive Account

Server Wrangler

Explorer

Sambassador

Explorer

FreeNAS Replicant

Important Announcement for the TrueNAS Community.

Related topics on forums.truenas.com for thread: "frequent change of mac addresses"

Similar threads