Oops, I read the post as if the MACs were duplicated. I have also come across a situtation where a faulty station (Wyse terminal actually) responded to all ARPs as if it owned the IP. I had an interesting conversation with Wyse support who remained convinced that it was impossible for their terminals to do that, since they weren't programmed that way. The fact that I had a packet capture of it happening didn't even phase them!
I ended up tracing down the Wyse terminal via its MAC (it wasn't changing ports as described in the original post) and replaced it. Windows computers use ARPs to detect duplicate IPs. Perhaps something similar is happening? It could also be a Proxy ARP issue. Zsombor Papp wrote: > There are duplicate IP addresses, not duplicate MACs. And all the duplicate > IP addresses come from the same MAC address, as if a single machine had > suddenly all the IP addresses configured on the same interface. I don't see > how this can be attributed to a L2 loop. > > Firesox, what is this phantom MAC address? > > Thanks, > > Zsombor > **Please support GroupStudy by purchasing from the GroupStudy Store: > http://shop.groupstudy.com > FAQ, list archives, and subscription info: http://www.groupstudy.com/list/cisco.html Message Posted at: http://www.groupstudy.com/form/read.php?f=7&i=73912&t=73868 -------------------------------------------------- **Please support GroupStudy by purchasing from the GroupStudy Store: http://shop.groupstudy.com FAQ, list archives, and subscription info: http://www.groupstudy.com/list/cisco.html
