Duplicate IP address using Mirrored switch ports

Question

Hi All,
Here's a good one. We use Websence and have an agent installed on one of our T1 Netras in a routed subnet. To collect info from all the traffic in that subnet we mirrored the uplink port to the gateway. Thus all traffic on that port is mirrored to the Solaris 10 box. Shortly after mirroring we started receiving duplicate ip address errors.
Hardware address '00:03:XX:XX:XX:XX' trying to be our address XXX.XXX.XXX.XXX.
With further investigation we discovered that when we ping a host that exists no error is generated. Pinging an ip that is not there produces the errors!
It seems that an ARP request that is not answered is being bounced back through the mirrored port. When the box sees this it thinks that another box is trying to send out the ARP broadcast.
With valid IP with snoop:
SUN01 -> 192.XXX.XXX.4 ICMP Echo request (ID: 615 Sequence number: 0)
192.XXX.XXX.4 -> (broadcast) ARP C Who is 192.XXX.XXX.10, SUN01 ?
SUN01 -> 192.XXX.XXX.4 ARP R 192.XXX.XXX.10, SUN01 is 0:3:ba:27:2e:9d
192.XXX.XXX.4 -> SUN01 ICMP Echo reply (ID: 615 Sequence number: 0)
With invalid IP with snoop:
SUN01 -> (broadcast) ARP C Who is 192.XXX.XXX.2, 192.XXX.XXX.2 ?
SUN01 -> (broadcast) ARP C Who is 192.XXX.XXX.2, 192.XXX.XXX.2 ?
No i didn't copy and paste it twice!! :p
Since nothing responds the box assumes that the message came from someone else. Its like talking into a mirror thinking that the reflection is speaking for you so you stop and complain that his lips moved!!
When looking at the arp table we found only a hand full of entries. Since there are around a 10 nodes we should see more. We removed the publish flag for the host and the duplicate IP problem goes away. Fixed, sorta. when all the arp caches clear we might run into the issue of not being able to communicate with it.
The cache on the box quickly filled up with arp entries. Another note, we use this box as a DHCP/BootP relay. Not sure if this will be affected.
I guess a possible workaround would be to set up an ARP proxy for this box , but not sure it will still report that there is another box with the same IP on the network.
Any Help with this is appreciated.
thank you

Answer 1

Sorry been on vacation the last couple of weeks...
I created this little script to fix the problem
root@srelay01:/etc/rc2.d> more S05arpset
#!/bin/sh
arp -s srelay01 00:03:ba:27:2e:9d
if you find that you need to broadcast try using the -p switch with it on another box. The problem is gone and the system interacts on the network fine. I would still love to know why this happens.
Good luck!