Wks received wrong mac address

[j.joe]

I was using 3560 as a routing switch. From time to time, my wks cannot access outside the subnet. When checking the arp table on my wks, I found the mac address of the 3560 was wrong. I can clear the arp cache in the switch and make my wks resumed.

What's wrong?

[vijayasankar]

Hi Joe,

What is the mac address that you are observing on the problematic workstations, when this issue is observed.? If you found it to be a valid mac address other than that of the 3560, there is a high chance that it is something to do with IP Clash.. probably someone else on your lan is also using the ip address assigned to the 3560....

HTH

-VJ

[j.joe]

The wrong mac address is a mystery. I cannot find any machine with this address. Actaully this is not only affecting my wks, even other wks and the server were found the same problem.

[vijayasankar]

Hi,

As pointed out by Jack, could you provide us more information on the setup..

1) Can you capture the mac-address for the default gateway from the workstations/server, when you face this problem.

2) During the problem occurence, Do you observe that the wrong mac address on all the problematic workstation/server is the same?

3) Is there any other router/firewalls in your setup...

-VJ

[j.joe]

1)Yes they (wks/servers only) are all pointing to a the same wrong mac address.

2)Firewall and switch attached to it did not have such problem

3)My connection like this:

Internet -- PIX -- 3560 (LAN gateway in Server room) -- 2970 (office floor switch)

[j.joe]

Just now, I have to manually map the static mac address for each wks/server to overcome this problem.

[vijayasankar · Accepted solution]

Hi Joe,

Thanks for the update.

For me, It still looks like a IP Conflict only...

If you have captured the mac address, then you can identify what device it is, which will help you out to find the root cause.

You can use this URL to check the vendor of the Mac-address from the OUI part. then you can track down the particular device in the network, to find out the problem.

http://www.coffer.com/mac_find/

HTH

-VJ

[jackyoung]

Why do you think the MAC is incorrect ? Can you provide more info. ? Is the wks point to the switch as default gateway ?

[j.joe]

Becoz in the console I can identify the mac address of the switch in the same subnet. And when my wks can talk to the switch, I can show and see its mac address was correct in the arp table of my wks. All wks point to the switch as default gateway.

Interestingly, only another switch 2970 and the PIX firewall did not get the wrong mac address.

[vijayasankar]

Hi Joe,

Have you tried tracing that wrong MAC address using the URL...

http://www.coffer.com/mac_find/

Were you able to track what device it is....?

-VJ

[j.joe]

Yes. Thanks for the help.

I tracked this should be from Nokia device. There are some Nokia firewalls in other segment and I am cross-checking with their mac address. Will keep you posted.

[vijayasankar]

Hi Joe,

Great.. Please update once you have narrowed down the issue.

Also rate the post, if it was helpful..

-VJ

[jackyoung]

Joe, could you please also provide the config. of the switch ?

[j.joe]

Hi,

To update you that the problem has been fixed. There was an IP conflict which was also used by a firewall setup (but no function now) 2 years ago.

Many thx for your assistance.

[vijayasankar]

Hi Joe,

Glad that the issue has been resolved now.

-VJ