ARP cache showing invalid mapping (?)

[Ricky Sandhu]

Good evening everyone,  wondering if someone can shed light on what might be happening here?  Got a call from a server guy that after installing Windows updates on a server and rebooting,  it's now showing a duplicate IP address/conflict in our data center.  The server in question has a static IP of 172.18.120.181. The device it's showing that's got an IP conflict with has a MAC address of aaaa.aaaa.aaaa as seen in the event logs.  Upon looking up this MAC address on the switch, its showing attached to port GigabitEthernet2/0/4.  This port directly connects to interface gigabitEthernet0 of our Cisco ACS server however this interface has a MAC address of aaaa.aaaa.aabb and IP address of 172.18.120.230.  It's (ACS) also got 3 other physical interfaces however they are not connected to anything.   When I check the arp table on the switch for IP address 172.18.120.181, it's got a mapping for aaaa.aaaa.aaaa as well.  Nothing changed on the ACS.  So how come this IP address which was statically assigned to the server is seen mapped to a seemingly non-existent MAC address on the port that ACS lives on?  Only thing I could think of is that this switch hasn't been rebooted for nearly 6 years and it's ARP cache might need to be cleared however that sounds like a stretch.  Any ideas?

[balaji.bandi]

We are not sure what switch is this, what code running, it would be nice that have information to suggest best.

Can you do the below test and let me know how it goes :

1. if a possible, shutdown or remove the exiting server connection, where it shows duplicate.

2. make sure server MAC address not changed with different (by any chance)

3. clear only that IP arp request.

4. after 10 Seconds check any IP ARP, MAC address in that table as same you have seen before?

5. after 1 or 2min of investigation, no duplicate MAC address found and confirmed,

6. connect the server and let us know how it goes.

if you have same issue again, please post the Logs from the switch to look, along with the below commands.

show ip arp | in x.x.x.x.x (ip address)

[Ricky Sandhu]

Hello BB,  the switch is a WS-C3750X-24 and it is running c3750e-universalk9-mz.122-55.SE1.bin

I logged in earlier today to perform the troubleshooting steps you specified however the server team had gone ahead and disabled/re-enabled the server NIC (again) and this time they started receiving response from the correct node on the network.  So we can say the issue is resolved,  however, why it occured in the first place and why did the IP get mapped to a physical MAC address that appeared to be on our Cisco ACS is beyond me.

[balaji.bandi]

Gald all resolved - Not sure we need to see more logs to understand.

May be MAC address is somewhere reserved or had a static entry.