My thanks to all who replied to my original query:
> Could someone tell me the most likely reason for the following message
> to appear in /var/adm/messages? I've never seen the like.
> seawall unix: IP: Hardware address '08:00:20:23:51:48' trying to be our
> address 159.017.005.083!
The overwhelming consensus was that there was a system on our network
which had appropriated "seawall's" IP address and that ARP was reporting the
alert to /var/adm/messages.
I initially thought the same thing, that a PC or somesuch had been attached to
the network using seawall's IP address. However, the ethernet address being
reported was in-fact seawall's address. The problem has not reappeared since
the original event(s).
At any rate, for diagnosing problems of this sort, a few respondents had
some advice to offer in trouble shooting:
>From Steve Phelps <email@example.com>:
> To check whether this is in fact caused by duplicate IP try the
> following test:
> ifconfig 159.17.5.XX
> where XX is an address definately NOT used.
> If errors go away then it is almost certainly caused by duplicate IP.
Another suggestion from Steve was to dump the ARP tables (arp -a) to get
the current MAC->IP translations that the server knows about.
>From Ray <firstname.lastname@example.org> comes first hand experience in this situation
where the problem turned out to be a faulty cabletron hub port. He recommends
checking hub port, cabling and patch revisions.
>From Perry Hutchison <email@example.com>, a more arcane suggestion:
> More far-fetched, maybe some router is trying to proxy-arp for it but
> on its own network (which is a no-no), however this should not cause it
> to report its own Ethernet address as the source of the bogus broadcast.
>From Adam Nevins <firstname.lastname@example.org> and Aggelos P. Varvitsiotis
<email@example.com> comes the reccomendation to use "snoop" or
"etherfind" to ferret out the culprit machine.
Again, my thanks to all who responded:
-- John S. Mclaughlin | "Can you tell me please, which way Citibank Delaware | to go from here?" asked Alice. (302) 324-6491 | "That depends a good deal on where firstname.lastname@example.org | You want to go," said the Queen.
This archive was generated by hypermail 2.1.2 : Fri Sep 28 2001 - 23:10:55 CDT