ARP request collision

[jasontan]

I am running an ASA 5510 box. Recently I started to receive alot of SNMP alerts,

----------------------------

Possible attack - Received ARP collision - 172.16.110.244 - 20 - Local use 4 - 4 - Warning

Received ARP request collision from 172.16.110.102/0014.5efd.6c3a on interface Inside

----------------------------

.244 is the firewall internal interface

.102 is my DHCP server, running NIC teaming.

I had not made changes to firewall at all and suddenly I got these.

I had issue a "clear arp" on ASA5510 but problem still persist.

Any solution?

[Kureli Sankar]

This is due to duplicate IP address in your network.  Two mac addresses are claiming to own one IP address.

Pls. track both the MAC addresses in question and verify the IP address configuration.

Also read this defect http://tools.cisco.com/Support/BugToolKit/search/getBugDetails.do?method=fetchBugDetails&bugId=CSCsj05830

-KS