weird ARP

[Craig Knights]

Can someone tell me if this is weird?

We're having some intermittent weirdness with our Mac print server,  

Last week, the printers started being sometimes unresponsive, a laptop reboot, or sleep would fix it, or not.  It's been happening on both fully up-to-date and out-of-date Macs.

to try to solve, I've updated the server to Sierra from Yosemite, and updated Papercut on both it, as the Secondary, and the Windows Papercut Primary to the latest v17 of Papercut (from v15)

It did complain once of "another computer is using the IP", it has a static IP.

So I've been doing a little ARP digging to see if something is also on that IP..

This is the bit I don't get:

after clearing the arp table:

the result is this weird MAC: 0:e0:91:b0:a4:7b with a missing first digit.

then after three lookups it changes to the correct ac:87:a3:30:21:31 until the next arp -d

if I add a 0 to that odd MAC, I get a manufacturer LG, which is odd or incorrect.

the MAC of my workstation is something totally different..

I tried the ping 1000 times and disconnect the server, didn't get anything from a duplicate IP.

Possibly someone up to no good with an ARP poisoning sniffer...  hmmmm

thanks,
Craig

[Alistair Baird]

Could be possible MAC spoofing. Did you see the post a few weeks ago about that app people were using to shut down other wifi users ?

--
You received this message because you are subscribed to the Google Groups "Techies for schools" group.
To unsubscribe from this group and stop receiving emails from it, send an email to techies-for-schools+unsub...@googlegroups.com.
For more options, visit https://groups.google.com/d/optout.

--

Alistair Baird

IT Manager

St Peters College 

p 06 354 4198

m 021 482 937

e bai...@stpeterspn.school.nz

[Craig Knights]

Yes I did.  It's been a long time since we've had that sort of thing happening..  We had a lot of trouble with that back in about 2005!

ta

CJK

On Fri, May 5, 2017 at 3:15 PM, Alistair Baird <bai...@stpeterspn.school.nz> wrote:

Could be possible MAC spoofing. Did you see the post a few weeks ago about that app people were using to shut down other wifi users ?

On 5 May 2017 at 15:04, Craig Knights <craig....@gmail.com> wrote:

Can someone tell me if this is weird?

We're having some intermittent weirdness with our Mac print server,  

Last week, the printers started being sometimes unresponsive, a laptop reboot, or sleep would fix it, or not.  It's been happening on both fully up-to-date and out-of-date Macs.

to try to solve, I've updated the server to Sierra from Yosemite, and updated Papercut on both it, as the Secondary, and the Windows Papercut Primary to the latest v17 of Papercut (from v15)

It did complain once of "another computer is using the IP", it has a static IP.

So I've been doing a little ARP digging to see if something is also on that IP..

This is the bit I don't get:

after clearing the arp table:

the result is this weird MAC: 0:e0:91:b0:a4:7b with a missing first digit.

then after three lookups it changes to the correct ac:87:a3:30:21:31 until the next arp -d

if I add a 0 to that odd MAC, I get a manufacturer LG, which is odd or incorrect.

the MAC of my workstation is something totally different..

I tried the ping 1000 times and disconnect the server, didn't get anything from a duplicate IP.

Possibly someone up to no good with an ARP poisoning sniffer...  hmmmm

thanks,
Craig

--
You received this message because you are subscribed to the Google Groups "Techies for schools" group.

To unsubscribe from this group and stop receiving emails from it, send an email to techies-for-schools+unsubscribe...@googlegroups.com.

For more options, visit https://groups.google.com/d/optout.

--

Alistair Baird

IT Manager

St Peters College 

p 06 354 4198

m 021 482 937

e bai...@stpeterspn.school.nz

[Tracy Briscoe]

Hi Craig

 

Have you had a look at the forwarding tables on your switches?

You should be able to trace the which port the device is connected to on your switches.  I’ve had to do that recently when someone plugged a home router with DHCP turned on into our network.

 

Regards,

 

Mr Tracy Briscoe

Network Engineer

 

St Peter's School, Cambridge, New Zealand

www.stpeters.school.nz

--

You received this message because you are subscribed to the Google Groups "Techies for schools" group.

To unsubscribe from this group and stop receiving emails from it, send an email to techies-for-sch...@googlegroups.com.

For more options, visit https://groups.google.com/d/optout.

Note: This communication may contain privileged and confidential information intended only for the addressee named above. Any views or opinions presented are solely those of the author. If you have received this message in error, we request you delete the message and notify the sender. Please do not distribute, copy or disclose any information. This e-mail has been scanned for viruses but all liability for viruses or similar in any attachment or message is excluded.

St Peter's School, Cambridge, New Zealand
Telephone: 647 827 9899 Fax: 647 827 9812
Website: www.stpeters.school.nz

Please consider the environment before printing this email

[Craig Knights]

Yes i started that process.

To unsubscribe from this group and stop receiving emails from it, send an email to techies-for-schools+unsub...@googlegroups.com.

For more options, visit https://groups.google.com/d/optout.

Note: This communication may contain privileged and confidential information intended only for the addressee named above. Any views or opinions presented are solely those of the author. If you have received this message in error, we request you delete the message and notify the sender. Please do not distribute, copy or disclose any information. This e-mail has been scanned for viruses but all liability for viruses or similar in any attachment or message is excluded.

St Peter's School, Cambridge, New Zealand
Telephone: 647 827 9899 Fax: 647 827 9812
Website: www.stpeters.school.nz

Please consider the environment before printing this email

--
You received this message because you are subscribed to the Google Groups "Techies for schools" group.

To unsubscribe from this group and stop receiving emails from it, send an email to techies-for-schools+unsub...@googlegroups.com.