Topic: ARPing changes mac address of client after third ping

The content of this topic has been archived on 30 Mar 2018. There are no obvious gaps in this topic, but there may still be some posts missing at the end.

Page 1 of 1

Post #1

rgarcia

28 Jun 2017, 20:41

I am having a very strange issue with one specific IP address.

So for the beginning, I have installed a raspberry, which I have named rpi04 and reserved 192.168.1.40 as IP address for its mac address. The rpi has received the IP address so this worked fine. When I now try to ping the host from the router I see this:

root@OpenWrt:~# ping 192.168.1.40
PING 192.168.1.40 (192.168.1.40): 56 data bytes
64 bytes from 192.168.1.40: seq=0 ttl=128 time=3436.148 ms
64 bytes from 192.168.1.40: seq=1 ttl=128 time=3598.520 ms
64 bytes from 192.168.1.40: seq=2 ttl=128 time=4426.562 ms

So you see super high latency.
Looking around I found the following weired thing:
By looking into the ARP table I can see that the rpi has the following mac addresse b8:27:eb:15:f4:7f.
When I run a arping now I see this:

root@OpenWrt:~# arping 192.168.1.40 -I br-lan
ARPING to 192.168.1.40 from 192.168.1.100 via br-lan
Unicast reply from 192.168.1.40 [b8:27:eb:15:f4:7f] 0.791ms
Unicast reply from 192.168.1.40 [b8:27:eb:15:f4:7f] 0.406ms
Unicast reply from 192.168.1.40 [b8:27:eb:15:f4:7f] 0.424ms
Unicast reply from 192.168.1.40 [0:ac:c2:5a:ed:33] 747.480ms
Unicast reply from 192.168.1.40 [0:ac:c2:5a:ed:33] 543.375ms
Unicast reply from 192.168.1.40 [0:ac:c2:5a:ed:33] 958.044ms

I also would like to mention that same happens with another rpi that I tried for testing.
Does somebody have an idea about what the heck is going on here?

Thanks

(Last edited by rgarcia on 28 Jun 2017, 20:43)

Post #2

Taulin

30 Jun 2017, 10:49

How does your system looks like?

I don´t understand it exactly but i guess it´s something like this?

Wifi or LAN -> router -> router LAN -> rpi ?

So you bridge one of your Interfaces to the LAN port of your router connected to the pi?
After this you ping from the router to the pi i guess.
This can have different reasons.

1. There is another member in your system with the same IP
2. The Pi has also connected a wifi module with the same IP
3. (Im not quiet sure about this) you ping also on the other side of the bridged LAN (normally for br-lan u have to merge two Interfaces like for example wwan0 + eth0 or eth0 + eth1) so u also ping on both Interfaces and maybe on one of this there is a member with the same ip.

I would prefer to ping on the specifc Interface (like eth0 ect.) which is directly connected to your pi and check if the same happens. If not i guess on your bridged Interface is a member with the same ip.

Post #3

rgarcia

1 Jul 2017, 16:27

The system setup is pretty basic.
Below are the DHCP reservations that I have in place.

config dnsmasq
        option domainneeded '1'
        option boguspriv '1'
        option localise_queries '1'
        option rebind_protection '1'
        option rebind_localhost '1'
        option local '/lan/'
        option domain 'lan'
        option expandhosts '1'
        option authoritative '1'
        option readethers '1'
        option leasefile '/tmp/dhcp.leases'
        option resolvfile '/tmp/resolv.conf.auto'
        option localservice '0'
        option nonwildcard '0'

config dhcp 'lan'
        option interface 'lan'
        option leasetime '8h'
        option start '200'
        option limit '50'
        option force '1'
        list dhcp_option '42,192.168.1.100'

config dhcp 'wan'
        option interface 'wan'
        option ignore '1'

config odhcpd 'odhcpd'
        option maindhcp '0'
        option leasefile '/tmp/hosts/odhcpd'
        option leasetrigger '/usr/sbin/odhcpd-update'

config host
        option name 'tablet-raul'
        option ip '192.168.1.110'
        option mac '68:94:23:xx:xx:xx'

config host
        option ip '192.168.1.115'
        option mac '1c:b7:2c:xx:xx:xx'
        option name 'pc-raul'

config host
        option name 'handy-raul'
        option ip '192.168.1.125'
        option mac '2c:cc:15:xx:xx:xx'

config host
        option name 'raspberrypi01'
        option ip '192.168.1.10'
        option mac '7e:5a:a6:xx:xx:xx'

config host
        option mac '00:11:22:33:44:55'
        option ip '192.168.1.155'
        option name 'reserveration1'

config host
        option name 'raspberrypi02'
        option mac 'b8:27:eb:xx:xx:xx'
        option ip '192.168.1.20'

config domain
        option ip '192.168.1.10'
        option name 'libreelec'

config host
        option name 'raspberrypi03'
        option mac 'b8:27:eb:xx:xx:xx'
        option ip '192.168.1.30'

config dhcp
        option start '100'
        option limit '150'
        option interface 'guests'
        option leasetime '1h'
        option force '1'
        list dhcp_option '42,192.168.3.1'

config domain
        option name 'shc'
        option ip '192.168.1.30'

config host
        option name 'nb-raul'
        option ip '192.168.1.180'
        option mac '48:51:b7:xx:xx:xx'

config host
        option name 'iphone-raul'
        option mac '1c:5c:f2:xx:xx:xx'
        option ip '192.168.1.185'

config host
        option name 'tv'
        option mac 'd8:af:f1:xx:xx:xx'
        option ip '192.168.1.130'

config host
        option name 'raspberrypi04'
        option mac 'b8:27:eb:xx:xx:xx'
        option ip '192.168.1.4'

config host
        option name 'netgear'
        option mac '20:4e:7f:xx:xx:xx'
        option ip '192.168.1.120'

config host
        option name 'reservation2'
        option mac '11:22:33:44:55:66'
        option ip '192.168.1.135'

config host
        option name 'rpi04'
        option mac 'b8:27:eb:xx:xx:xx'
        option ip '192.168.1.40'

Regarding your questions:
1. No other member with that IP address in the network
2. Older raspberry model without wifi modul
3. ifconfig only Shows the option to use the br-lan device Interface.

Checking the arp table of the device I am getting the following:

IP address       HW type     Flags       HW address            Mask     Device
192.168.1.40     0x1         0x2         00:ac:c2:xx:xx:xx     *        br-lan

Pinging the IP address directly from the router results in the following:

root@OpenWrt:~# ping 192.168.1.40
PING 192.168.1.40 (192.168.1.40): 56 data bytes
64 bytes from 192.168.1.40: seq=0 ttl=128 time=2665.310 ms
64 bytes from 192.168.1.40: seq=1 ttl=128 time=2462.249 ms
64 bytes from 192.168.1.40: seq=2 ttl=128 time=2514.617 ms

DHCP log

root@OpenWrt:~# logread | grep .1.40
Sat Jul  1 17:01:40 2017 daemon.info dnsmasq-dhcp[9646]: DHCPREQUEST(br-lan) 192.168.1.238 da:d2:92:30:b9:7f
Sat Jul  1 17:01:40 2017 daemon.info dnsmasq-dhcp[9646]: DHCPACK(br-lan) 192.168.1.238 da:d2:92:30:b9:7f securenat-dad29230b97f
Sat Jul  1 17:30:55 2017 daemon.warn dnsmasq-dhcp[9646]: not using configured address 192.168.1.40 because it is in use by another host
Sat Jul  1 17:31:02 2017 daemon.info dnsmasq-dhcp[9646]: DHCPOFFER(br-lan) 192.168.1.40 b8:27:eb:15:f4:7f
Sat Jul  1 17:31:02 2017 daemon.info dnsmasq-dhcp[9646]: DHCPREQUEST(br-lan) 192.168.1.40 b8:27:eb:15:f4:7f
Sat Jul  1 17:31:02 2017 daemon.info dnsmasq-dhcp[9646]: DHCPACK(br-lan) 192.168.1.40 b8:27:eb:15:f4:7f rpi04

I really dont understand what the heck is going on...

(Last edited by rgarcia on 1 Jul 2017, 16:33)

Post #4

mk24

1 Jul 2017, 17:00

I would start by disconnecting the Pi to make sure that nothing else answers the ping.

Post #5

rgarcia

2 Jul 2017, 08:05

Done IP address is still pingable o_O

root@OpenWrt:~# ping 192.168.1.40
PING 192.168.1.40 (192.168.1.40): 56 data bytes
64 bytes from 192.168.1.40: seq=0 ttl=128 time=910.296 ms
64 bytes from 192.168.1.40: seq=1 ttl=128 time=1607.267 ms
64 bytes from 192.168.1.40: seq=2 ttl=128 time=2038.406 ms
64 bytes from 192.168.1.40: seq=3 ttl=128 time=1202.559 ms
64 bytes from 192.168.1.40: seq=4 ttl=128 time=1004.093 ms
64 bytes from 192.168.1.40: seq=5 ttl=128 time=1114.323 ms
64 bytes from 192.168.1.40: seq=6 ttl=128 time=1755.068 ms
64 bytes from 192.168.1.40: seq=7 ttl=128 time=885.444 ms
64 bytes from 192.168.1.40: seq=8 ttl=128 time=1207.086 ms

I cannot find nothing about a manufactorer for this mac address 00:ac:c2:5a:ed:33
Totally confused right now

Post #6

rgarcia

2 Jul 2017, 08:14

Alright I found the issue... seems like one of my raspberries was holding the .4 and the .40. Not sure how it came to the idea to hold the .40 but after restarting it, it worked all fine again. Thanks for help Troubleshooting this
Much appreciated

The discussion might have continued from here.

Page 1 of 1