What is the best way to investigate ARP collisions?

rweir0001 · ‎05-21-2015

Hi,

I am running a 5510 ASA and it received multiple ARP collisions from one of our work stations:

ASA-4-405001

90fb.a60a.b651

000c.290e.4bef

I logged on to the workstation and confirmed that the top MAC address is the correct one, and that is also the one in the MAC address table of the ASA. The workstation also only has one network adapter, so I believe that I have ruled out NIC teaming as a possibility for the collisions.

What steps can I do to try and determine the source of the offending MAC address that caused the collisions?

johnlloyd_13 · ‎05-21-2015

hi,

what's your network topology like?

are the 2 workstations connected to a switch?

rweir0001 · ‎06-01-2015

The workstation is connected to a switch. In the case above, we have a workstation with a MAC address of 90fb.a60a.b651. Our ASA is occasionally generating log entries saying that there is an ARP collision involving the IP address of that workstation due to it trying to use a different MAC address. The incorrect MAC is 000c.290e.4bef, which appears to be a VMWare MAC address. The workstation in question is a physical device, but we do have lots of VM servers in our environment, and we use VDI for remote connections.

I'm trying to figure out where the incorrect MAC address, 000c.290e.4bef, is coming from because it shouldn't be coming from that workstation.

Is there a method to track down the computer using that MAC address even though the ASA is seeing that MAC connected to a PC that it doesn't belong to?