RE: Multiple ip addresses with single Mac address

Many devices re-use mac addresses on different logical vlans... not big deal.

You need to learn this site:

http://standards.ieee.org/develop/regauth/oui/public.html

I see 021f.a000.0041

Is not listed in the database... hmmm... ah - it's a type of multicast mac - check it - its starts with "02"

Now lets google the OUI -

Nothing...

So shut off the ports on the switch and see who yells... :)

-----Original Message-----
From: nobody_at_groupstudy.com [mailto:nobody_at_groupstudy.com] On Behalf Of ramesh Kumar
Sent: Saturday, January 05, 2013 5:57 PM
To: ccielab_at_groupstudy.com
Subject: Multiple ip addresses with single Mac address

Hello Experts,

I am seeing this on my switch packet capture 18256465.802229MS-NLB-PhysServer-31_a0:00:00:41BroadcastARP92Gratuitous ARP for 172.20.196.123 (Reply)[Packet size limited during capture]

I want to
trace the hosts which are generating these gratuitous arp in the network.
SW1# sh ip arp | i 172.20.196.123
172.20.196.123 00:00:23 021f.a000.0041
 Vlan1960

SW1# sh mac address-table | i 021f.a000.0041
* 650
 021f.a000.0041 dynamic 0 F F Po9
* 720 021f.a000.0041
   dynamic 30 F F Po9
* 790 021f.a000.0041 dynamic 0
       F F Po9
* 1960 021f.a000.0041 dynamic 30 F F
 Po9

Port-channel 9 is connecting to a Load balancer which is trunking the above vlans. When I check the mac table in LB it points back to the switch once again. So the mac is pointing back and forth between the switch and the LB. I dont know where is the source of the mac located.

Also I see a single
mac address bound to different IP's in the same network. When do we see such scenarios?

SW1# sh ip arp | i 021f.a000.0041
172.20.201.10 00:00:21
 021f.a000.0041 Vlan2010
172.20.201.12 00:00:21 021f.a000.0041
 Vlan2010
172.20.196.10 00:00:22 021f.a000.0041 Vlan1960
172.20.196.11 00:00:21 021f.a000.0041 Vlan1960

Again when we trace
this mac address it takes to the LB

SW1# sh mac add | i 021f.a000.0041
* 650
     021f.a000.0041 dynamic 0 F F Po9
* 720
 021f.a000.0041 dynamic 30 F F Po9

Is this a common
scenarios when we have trunks configured in the network ?

Ramesh

Blogs and organic groups at http://www.ccie.net
Received on Sat Jan 05 2013 - 23:13:05 ART