Arpwatch and NICS

Aly Dharshi aly.dharshi at
Mon Mar 11 02:35:01 CST 2002

Hi All,

    Recently our Network Admin has been complaining that his arpwatch returns messages such as (attachements are from my run of arpwatch):

    subject:    reused old ethernet address (
    ip address:
    ethernet address: 0:2:b3:8f:12:b4
    ethernet vendor: <unknown>
    old ethernet address: 0:6:5b:39:36:fd
    old ethernet vendor: <unknown>
    timestamp: Thursday, March 7, 2002 4:46:12 -0700
    previous timestamp: same as above
    delta: 0 seconds

    What is interesting is that there are 2 NICs broadcom 5700, 2 Intel express pros.

    polaris is the bcm5700 eth0
    pisces 1st Intel Pro 100 eth1
    pictor 2nd Intel Pro 100 eth2

    We set them up as eth0, eth1 and eth2 via linuxconf.

    Now ethernet address is of pisces, old ethernet address is of pictor and if the card ends in "fe" then its polaris. We have even had reports of flip flop of addresses. 

    Please help, I have looked thru all the logs that I can find and know about, nothing, it seems that everything is still going out thru eth2 despite attempts to force things thru the broadcom eth0. NFS mounts, chats with our LDAP server which we expect to go thru eth0 go thru eth2.

    Any advice or help would be much appreciated. ARP commands out puts the following:

    Address                  HWtype  HWaddress           Flags Mask            Iface   ether   08:00:20:8D:F1:59   C                     eth2        ether   AA:00:04:00:03:C0   C                     eth2
Entries: 2      Skipped: 0      Found: 2

    Thank you very much.


-------------- next part --------------
An HTML attachment was scrubbed...
-------------- next part --------------
An embedded message was scrubbed...
From: arpwatch at
Subject: changed ethernet address (
Date: Mon, 11 Mar 2002 00:09:10 -0700
Size: 1475
-------------- next part --------------
An embedded message was scrubbed...
From: arpwatch at
Subject: new station (
Date: Mon, 11 Mar 2002 00:09:10 -0700
Size: 1301

More information about the Linux-PowerEdge mailing list