ARP question

[gksh...@ucdavis.edu]

Hi, I don't know if anyone still monitors this newgroup, but
I have a question.

Recently I started to get tons of log messages like these:

Mar 5 14:37:46 bogslab /kernel: arp: 169.237.68.254 moved from 00:00:a2:cb:30:51 to 00:00:a2:cb:2e:30 on ep0
Mar 5 14:37:55 bogslab /kernel: arp: 169.237.68.254 moved from 00:00:a2:cb:2e:30 to 00:00:a2:cb:30:51 on ep0
Mar 5 14:38:00 bogslab /kernel: arp: 169.237.68.254 moved from 00:00:a2:cb:30:51 to 00:00:a2:cb:2e:30 on ep0
Mar 5 14:38:06 bogslab /kernel: arp: 169.237.68.254 moved from 00:00:a2:cb:2e:30 to 00:00:a2:cb:30:51 on ep0
Mar 5 14:38:27 bogslab /kernel: arp: 169.237.68.254 moved from 00:00:a2:cb:30:51 to 00:00:a2:cb:2e:30 on ep0
Mar 5 14:39:09 bogslab /kernel: arp: 169.237.68.254 moved from 00:00:a2:cb:2e:30 to 00:00:a2:cb:30:51 on ep0
Mar 5 14:39:20 bogslab /kernel: arp: 169.237.68.254 moved from 00:00:a2:cb:30:51 to 00:00:a2:cb:2e:30 on ep0

Notice how fast the MAC is changing.

It should be mentioned that 169.237.68.254 is the gateway for our
department.

I see at least three possible causes. (1) I have something
misconfigured in my system, such as the netmask. (2) There are
two machines in the departmental network that are responding to
169.237.68.254 (possibly with some kind of malicious intent). (3)
The Nortel box(es?) corresponding to 169.237.68.254 is doing some
kind of load-balancing using two NICs and therefore two MACs.

I really don't see either 1 or 2 as strong possibilities, since
we haven't been seeing the large numbers of errors or degradation
of service that one would expect if either were true. However,
it would be comforting to know for sure that all it is is some
kind of heavy-handed load balancing.

Greg Shenaut