Multiple ip addresses with single Mac address

Hello Experts,

I am seeing this on my switch packet capture
18256465.802229MS-NLB-PhysServer-31_a0:00:00:41BroadcastARP92Gratuitous ARP
for 172.20.196.123 (Reply)[Packet size limited during capture]

I want to
trace the hosts which are generating these gratuitous arp in the network.
SW1# sh ip arp | i 172.20.196.123
172.20.196.123 00:00:23 021f.a000.0041
 Vlan1960

SW1# sh mac address-table | i 021f.a000.0041
* 650
 021f.a000.0041 dynamic 0 F F Po9
* 720 021f.a000.0041
   dynamic 30 F F Po9
* 790 021f.a000.0041 dynamic 0
       F F Po9
* 1960 021f.a000.0041 dynamic 30 F F
 Po9

Port-channel 9 is connecting to a Load balancer which is trunking the
above vlans. When I check the mac table in LB it points back to the switch
once again. So the mac is pointing back and forth between the switch and the
LB. I dont know where is the source of the mac located.

Also I see a single
mac address bound to different IP's in the same network. When do we see such
scenarios?

SW1# sh ip arp | i 021f.a000.0041
172.20.201.10 00:00:21
 021f.a000.0041 Vlan2010
172.20.201.12 00:00:21 021f.a000.0041
 Vlan2010
172.20.196.10 00:00:22 021f.a000.0041 Vlan1960
172.20.196.11 00:00:21 021f.a000.0041 Vlan1960

Again when we trace
this mac address it takes to the LB

SW1# sh mac add | i 021f.a000.0041
* 650
     021f.a000.0041 dynamic 0 F F Po9
* 720
 021f.a000.0041 dynamic 30 F F Po9

Is this a common
scenarios when we have trunks configured in the network ?

Ramesh

Blogs and organic groups at http://www.ccie.net
Received on Sat Jan 05 2013 - 14:57:06 ART