05-21-2015 06:08 AM - edited 03-11-2019 10:58 PM
Hi,
I am running a 5510 ASA and it received multiple ARP collisions from one of our work stations:
ASA-4-405001
90fb.a60a.b651
000c.290e.4bef
I logged on to the workstation and confirmed that the top MAC address is the correct one, and that is also the one in the MAC address table of the ASA. The workstation also only has one network adapter, so I believe that I have ruled out NIC teaming as a possibility for the collisions.
What steps can I do to try and determine the source of the offending MAC address that caused the collisions?
05-21-2015 08:20 PM
hi,
what's your network topology like?
are the 2 workstations connected to a switch?
06-01-2015 12:10 PM
The workstation is connected to a switch. In the case above, we have a workstation with a MAC address of 90fb.a60a.b651. Our ASA is occasionally generating log entries saying that there is an ARP collision involving the IP address of that workstation due to it trying to use a different MAC address. The incorrect MAC is 000c.290e.4bef, which appears to be a VMWare MAC address. The workstation in question is a physical device, but we do have lots of VM servers in our environment, and we use VDI for remote connections.
I'm trying to figure out where the incorrect MAC address, 000c.290e.4bef, is coming from because it shouldn't be coming from that workstation.
Is there a method to track down the computer using that MAC address even though the ASA is seeing that MAC connected to a PC that it doesn't belong to?
Discover and save your favorite ideas. Come back to expert answers, step-by-step guides, recent topics, and more.
New here? Get started with these tips. How to use Community New member guide