Duplicate Source IP on VLAN

[F3nrir]

I'm currently stumped by this one, every so often I'm getting these logs on one of my Nexus 9k VPC pair. Is this indicative of a loop? I've been combing the forums on this and can't seem to find a concrete answer.

XXXXXX %ARP-2-DUP_SRC_IP:  arp [27343]  Source address of packet received from ee51.c59b.a314 on VlanX(port-channel1) is duplicate of local, X.X.X.X
XXXXXX %ARP-2-DUP_SRC_IP:  arp [27343]  Source address of packet received from ee51.c59b.a314 on VlanY(port-channel51) is duplicate of local, X.X.X.X
XXXXXX %ARP-2-DUP_SRC_IP:  arp [27343]  Source address of packet received from ee51.c59b.a314 on VlanX(port-channel1) is duplicate of local, X.X.X.X

[Giuseppe Larosa]

Hello F3nrir,

you may be facing some L2 issues here.

Is the listed MAC address used by the local switch ?

>>

ARP-2-DUP_SRC_IP:  arp [27343]  Source address of packet received from ee51.c59b.a314 on VlanX(port-channel1) is duplicate of local, X.X.X.X

If so the switch is receiving back some packets likely an ARP request that is sent as a broadcast.

This is the sign of a temporary bridging loop, because in a loop free topology broadcast frames  are flooded to all ports in Vlan but they do not come back.

However, you have two Nexus 9k deployed in pair with vPC. So perfom all consistency checks on vPCs.

Verify STP activity in the network.

Hope to help

Giuseppe

[F3nrir]

Hi @Giuseppe Larosa thank you for your reply.

The mac-address is not on the local switch that is why I am very confused. Po1 is the VPC peer link so I checked the peer as well and it does have this mac address either...

Will do my consistency checks now.

[Matt Delony]

Hello F3nrir,

The error is indicating that ARP traffic with "Sender protocol address" was same as IP address configured on the Nexus 9k VPC pair. If the MAC address it specified is not belonging to the nexus, then it can indicate possible ARP spoofing from another host in same VLAN as listed on the error message. The listed MAC address would be the source MAC of the ARP traffic.

I looked up the vendor OUI, but I can't find an entry for it. See if you can track down where this MAC address is located.

also, I have seen IP device tracking ARP probe config on Catalyst C3650/C3850/C9k switches unintentionally spoof gateway address. Check if you have any of these model switches with config like: "ip device tracking probe auto-source fallback 0.0.0.1 255.255.255.0 override" (reference).

[F3nrir]

Hi @Matt Delony Thanks for your reply,

I'm going to see what I can track down. The other port-channel is connecting to a blade chassis I'm going to look into that as well. Will let you know If I have an update. Thanks!