Buy or Renew
Buy or Renew
cancel
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for 
Search instead for 
Did you mean: 
cancel
Start a conversation
1696
Views
0
Helpful
3
Replies

Syslog message: Received ARP response collision

brian975
Level 1
Level 1

‎06-24-2004 07:26 AM - edited ‎03-09-2019 07:50 AM

My syslog records at least one of these messages each minute.

-------------------

<164>Jun 23 2004 23:59:55: %PIX-4-405001: Received ARP request collision from 192.55.9.10/0006.5bf2.7f42 on interface inside

-------------------

<164>Jun 23 2004 23:59:55: %PIX-4-405001: Received ARP response collision from 192.55.9.10/0002.b3c3.10fa on interface inside

-------------------

Is this an issue that I should be concerned about? The MAC addresses mentioned are from servers that have two Intel NICs teamed into one virtual adapter to provide failover protection.

Thanks

Labels:
0 Helpful
3 Replies 3

gfullage
Cisco Employee
Cisco Employee

‎06-24-2004 06:06 PM

This message is just indicating that the PIX received an ARP packet for an IP/MAC combination that was different to what it had in its ARP cache. If these two MAC's have the same IP address for a valid reason, then it's not anything to worry about.

You can stop the PIX sending these out with the following:

no logging message 405001

0 Helpful

jonathanstevens
Level 1
Level 1
In response to gfullage

‎06-25-2004 12:26 AM

This is interesting, because I am also seeing a glut of these messages on a FWSM.

Strangely though, the IP address in the ARP is that of the firewall itself.

We have determined that there is no other host using this IP address (turn off fw interface, no arp response to ping on the IP address).

It is possible that a DHCP server may be involved, but even after the IP address was removed from it's scope (yes, not sure how it got in there in the first place), we are still seeing the ARP response collisions.

0 Helpful

jonathanstevens
Level 1
Level 1
In response to jonathanstevens

‎06-25-2004 01:05 AM

As an addendum here is an example...

The IP on the interface is 192.168.19.161, and as you can see there are a multitude of MACs concerned.

%FWSM-4-405001: Received ARP request collision from 192.168.19.161/000d.6019.5518 on interface DEV_VLAN

%FWSM-4-405001: Received ARP request collision from 192.168.19.161/0010.1803.6d9a on interface DEV_VLAN

%FWSM-4-405001: Received ARP request collision from 192.168.19.161/0009.6bb5.b256 on interface DEV_VLAN

%FWSM-4-405001: Received ARP request collision from 192.168.19.161/0009.6bb5.82ba on interface DEV_VLAN

%FWSM-4-405001: Received ARP request collision from 192.168.19.161/0009.6bb5.18c2 on interface DEV_VLAN

%FWSM-4-405001: Received ARP request collision from 192.168.19.161/0009.6bb5.820e on interface DEV_VLAN

%FWSM-4-405001: Received ARP request collision from 192.168.19.161/0009.6bb5.8227 on interface DEV_VLAN

%FWSM-4-405001: Received ARP request collision from 192.168.19.161/0009.6bb5.82bc on interface DEV_VLAN

%FWSM-4-405001: Received ARP request collision from 192.168.19.161/000d.6019.5670 on interface DEV_VLAN

%FWSM-4-405001: Received ARP request collision from 192.168.19.161/0009.6bb5.82bb on interface DEV_VLAN

%FWSM-4-405001: Received ARP request collision from 192.168.19.161/0009.6bb5.18c3 on interface DEV_VLAN

%FWSM-4-405001: Received ARP request collision from 192.168.19.161/0009.6bb5.820f on interface DEV_VLAN

%FWSM-4-405001: Received ARP request collision from 192.168.19.161/0009.6bb5.8226 on interface DEV_VLAN

%FWSM-4-405001: Received ARP request collision from 192.168.19.161/0009.6bb5.82bd on interface DEV_VLAN

%FWSM-4-405001: Received ARP request collision from 192.168.19.161/0010.1803.6d9a on interface DEV_VLAN

%FWSM-4-405001: Received ARP request collision from 192.168.19.161/000d.6019.5670 on interface DEV_VLAN

%FWSM-4-405001: Received ARP request collision from 192.168.19.161/0010.1803.6f84 on interface DEV_VLAN

%FWSM-4-405001: Received ARP request collision from 192.168.19.161/0009.6bff.0f6e on interface DEV_VLAN

%FWSM-4-405001: Received ARP request collision from 192.168.19.161/0009.6bff.0f6f on interface DEV_VLAN

%FWSM-4-405001: Received ARP request collision from 192.168.19.161/0009.6bff.0f6e on interface DEV_VLAN

%FWSM-4-405001: Received ARP request collision from 192.168.19.161/0009.6bff.0f6f on interface DEV_VLAN

%FWSM-4-405001: Received ARP request collision from 192.168.19.161/000d.6019.5518 on interface DEV_VLAN

%FWSM-4-405001: Received ARP request collision from 192.168.19.161/0009.6bff.0f89 on interface DEV_VLAN

%FWSM-4-405001: Received ARP request collision from 192.168.19.161/0009.6b89.8160 on interface DEV_VLAN

%FWSM-4-405001: Received ARP request collision from 192.168.19.161/0009.6b89.8161 on interface DEV_VLAN

%FWSM-4-405001: Received ARP request collision from 192.168.19.161/0009.6b89.8160 on interface DEV_VLAN

0 Helpful
Customers Also Viewed These Support Documents