Syslog message on DUPLICATE ADDRESS event

hi,
I am working on two cisco routers. my rquirement is .. if i assign same address for two interfaces of different router, i have to receive DUPLICATE ADDRESS event. I was getting this syslog message, some months ago.
But now, when I try the same, I am not receiving any DUPLICATE ADDRESS event on the Router Terminal.
ex: Router 1 : Interface gigabitethernet 0/0 - ip address 192.168.100.1 mask 255.255.255.0
Router 2 : Interface gigabitethernet 0/0 - ip address 192.168.100.1 mask 255.255.255.0
in this case i should the syslog message. (DUPLICATE ADDRESS)
I was receiving such message, two months before.
now i dont know what is happening
I have to receive that syslog message for one of my project.
kindly help me
Thanks in Advance

Duplicate post.
Go HERE.

Similar Messages

Syslog. Include IP address of VTY in every message (configuration changes)

Hello guys,
I have discovered that Huawei has a different syslog messages format when it comes to logging configuration changes in external syslog, however if in Cisco you are using a universal login for many users, it is impossible to know what IP address logged what command..
I know, a solution would be to let every user use its own login, however, I wanted to know is there a way for a Cisco router to associate the vty of the "logged command" originator and include this information in Syslog.
Here is the example for Huawei:
%%10SHELL/5/CMD(l):-DevIP=10.219.3.2- 2 -task:vt0 ip:10.200.7.138 user:** command:display logbuffer
Cisco kind of includes the final message where is tells what was the IP address of the VTY, however, this IP address is not present in every syslog message as in Huawei.
68954: 168799: Sep 22 14:29:21.839: %PARSER-5-CFGLOG_LOGGEDCMD: User:XXXXX logged command:no logging host 10.200.100.10 transport udp port 515
68952: 168796: Sep 22 14:18:25.341: %PARSER-5-CFGLOG_LOGGEDCMD: User:XXXXX logged command:exit
68953: 168797: Sep 22 14:18:26.053: %SYS-5-CONFIG_I: Configured from console by XXXXX on vty5 (10.200.7.138)
Is it possible to do something similar in Cisco

If you have Splunk or another enterprise log reporting server you can correlate those events by building a transaction whenever you see a %SYS-5-CONFIG_I event. I have support for this in my Cisco Networks app for Splunk: https://apps.splunk.com/app/1352/ & https://apps.splunk.com/app/1467/
Have a look and see what you think.

HA NAT and %IP-4-DUPADDR: Duplicate address messages

Are the messages %IP-4-DUPADDR: Duplicate address expected with HA NAT?
With Stateful NAT they were seen if the "redundancy GROUP_NAME" was not added to the static NAT.
I am seeing them with a correctly configured HA NAT Box to Box set up and there does not seem to be anything missing that will stop the messages.
Is this a bug? Should the duplicate IP messages have been suppressed?

James,
We have implemented it in 3 customers, all of them got the same crash problem (just 10 customers in the world opened a ticket with TAC and just opened 3 of them).
It will happen a lot o times during the day. Be prepared. I didnt monitor the frequency but we needed to shut the secondary router down until Cisco do something to solve.
Unfortunately this is becoming very common with Cisco softwares. Not only with routers and switches, but with others solution too.

Nexus 5548 - %ARP-3-DUP_SRCIP_PROBE: Duplicate address Detected

Hello.
Looking for some assistance on the following please, I'll try to include a lot of detail:
I noticed we're receiving repeating messages on a pair of Nexus 5548UP switches, regarding duplicate IP's, and the IP's in question are the mgmt0 of each respective Nexus switch; which are connected to each other and uplinked to two 3750X switches which are also linked to each other (not as a stack, with optics).
Here is a sample of the syslog message: %ARP-3-DUP_SRCIP_PROBE: arp [####] Duplicate address Detected. Probe packet received from zzzz.zzzz.zzzz on mgmt0 with destination set to our local ip, xxx.xxx.xxx.xxx
And in ascii art, here is a diagram: SW1&2 are 3750X (running 15.x code) and NX1&2 are Nexus 5548UP (running 6.x code)
SW1---SW2
| |
NX1---NX2
Pretty basic box/"ring", just in case the diagram doesn't format well, with rapid spanning-tree in effect. The Nexus are Layer2 only, and the 3750X's are Layer 2 & 3 /w HSRP on a few SVI's in them. All vlans can pass over the connecting trunks. And on the Nexus, the management interface (mgmt0) is connected to 3750X (NX1 to SW1 and NX2 to SW2); e.g. management is done over this vrf interface, versus it flowing through a trunk interface to a SVI on the Nexus.
I know these messages to be erroneous as far an being actual duplicate IP's on the network, and have seen a few posts that indicate a command ("no ip arp gratuitous hsrp duplicate") typically referencing a Nexus 7000 setup has helped, but obviously as described that's not involved here. Note: Placing that command on the mgmt0 interface of the two nexus had no positive effect. The messages didn't start showing until after HSRP was enabled on the applicable 3750X SVI's - so seems a likely correlation.
Essentially looking to clear this up (ideally) or suppress the messages since they're false. Any ideas?
Thanks!

For those encountering this same issue, here is some information that may lead you to a resolve.
I decided to open a TAC case to get some direct assistance, and I was directed to the 3750X's and a new feature in the 15.x code, "ip device tracking". I was directed to remove that without specific details / steps on how to best do it (e.g. "no ip device tracking" does not remove it from the global config, as of 15.2(1)E anyway and is the most current at the time of this posting), and that didn't take, giving the message: % IP device tracking is disabled at the interface level by removing the relevant configs. However, after doing some research on the command, I can across some similar posts on 15.x code and duplicate IP messages.... Here's two posts I referenced:
https://supportforums.cisco.com/thread/2244042
https://supportforums.cisco.com/thread/2239656
I opted for the "no macro auto monitor" command in the 3750X's in global config, as mentioned in the above post(s) - This did stop the messages from occurring in the Nexus switches. IMPORTANT NOTE: I noticed that it did appear to bounce all the switch ports however, which could impact production - Be advised!
I cannot speak to if the interface level command 'nmsp attach suppress' is a better route to go, which is also referenced in the posts (first one primarily) - I went the other route to not have all the extra config line entries. I have asked Cisco what the true impact of the "no macro auto monitor" command is, and am waiting a response - Ideally there's little to none, probably depending on if you want to make use of device tracking or not... in my case, I suspect I don't have a need for this and thus there's no impact - I shall see.
It would be ideal if code is released to disable this service / feature in the future more gracefully and/or code changes are done to remedy this issue so you can have the feature enabled (or not). I akin this much like the "vstack" service that was introduced around 12.2(55/58)SE IOS that couldn't be disabled & left an open TCP port (not good for security scans), then with 12.2(58)SE2 they allowed it to be disabled (e.g. "no vstack" in global config).
Hopefully these details prove of value.
Regards.
NOTE: Since it doesn't seem you can"answer" your own posts, which seems silly; please note I consider this item resolved / answered.

Error message: 1021: Duplicate function definition.

Hi All,
First let me start by saying that I know next to nothing about Flash. I have inherited a website maintenance project that has a Flash rotating image banner. I have managed to get the images to fade-in and fade-out correctly, but now I need to make these images clickable - linking images to pages in the website. I have read many posts here and have reviewed the video tutorials. I have been able to get the first image clickable using this AS3 action:
mars_btn.addEventListener(MouseEvent.CLICK, buttonClickHandler);
function buttonClickHandler(event:MouseEvent) :void {
        navigateToURL(new URLRequest("http://somewebsite/mars.php"));
        trace("I'm clicked");
However, when I attempt to make another image clickable by using a different instance of a button I get the error message:
1021: Duplicate function definition.
I have a separate instance of a button with this AS3 action:
jupiter_btn.addEventListener(MouseEvent.CLICK, buttonClickHandler);
function buttonClickHandler(event:MouseEvent) :void {
        navigateToURL(new URLRequest("http://somewebsite/jupiter.php"));
        trace("I'm clicked");
Obviously I'm not understanding how I'm supposed to do this so that I don't create a duplicate function definition. Any help would be most appreciated.

excuse me , I have a question i hope that you help .. ( im new in here )
we were asked to create an interactive application on flash in two languages..
so i created two different fla files same exact codings ... i was wondering how can i combine them so the viewer can be able to choose the language from a button ?
when i try to combine them i get lots of errors of duplications in the actionscript
PS : MY MAIN PAGE INCLUDES A CAROUSEL with images ..
I was thinking of saving one of the fla as a movie and then add it some how to the second fla and combine it with a button but i can't figure it how..
i hope i was clear enough.. but is there any possibility to help me please ?!
when i tend to change names or something it creates error.. ( IM NOT A PRO IN AS3 ) and when i dublicate the scenes it give duplication errors.. WHAT IS THE SOLUTION ??
this is the code of the actionscript in the main page.. ( the carousel's code i took from someone ) and i used it on my project
import com.ccanvas.carousel.*;
var centerX:Number = stage.stageWidth/4;
var centerY:Number = stage.stageHeight/4;
var carc:Carousel = new Carousel(centerX, centerY, 256, 75, "icons.xml");
carc.addTooltip(new tooltip); // use 'tooltip' movieclip for item tooltip
addChild(carc); // add carousel to stage
function down(event:MouseEvent):void {
trace(event.currentTarget.toolText); // simple click interaction
function destroyCarousel(event:MouseEvent):void {
carc.destroy(); // remove all item in carousel as well as tooltip
function removeNextItem(event:MouseEvent):void {
if(carc.numOfItems > 2) {
carc.removeItem(2); // remove the item next to the remove item icon
create.addEventListener("mouseDown", createCarousel);
function createCarousel(event:MouseEvent):void {
if(carc.CREATED == false) {
// recreate the carousel
carc = new Carousel(centerX, centerY, 256, 75, "icons.xml");
carc.addTooltip(new tooltip);
addChild(carc);
}/* Click to Go to Scene and Play
Clicking on the specified symbol instance plays the movie from the specified scene and frame.
Instructions:
1. Replace "Scene 3" with the name of the scene you would like play.
2. Replace 1 with the frame number you would like the movie to play from in the specified scene.
Tools_button.addEventListener(MouseEvent.CLICK, fl_ClickToGoToScene);
function fl_ClickToGoToScene(event:MouseEvent):void
MovieClip(this.root).gotoAndPlay(1, "Toolse");
}/* Click to Go to Scene and Play
Clicking on the specified symbol instance plays the movie from the specified scene and frame.
Instructions:
1. Replace "Scene 3" with the name of the scene you would like play.
2. Replace 1 with the frame number you would like the movie to play from in the specified scene.
games_button.addEventListener(MouseEvent.CLICK, fl_ClickToGoToGames);
function fl_ClickToGoToGames(event:MouseEvent):void
MovieClip(this.root).gotoAndPlay(1, "Gamese");
}/* Click to Go to Scene and Play
Clicking on the specified symbol instance plays the movie from the specified scene and frame.
Instructions:
1. Replace "Scene 3" with the name of the scene you would like play.
2. Replace 1 with the frame number you would like the movie to play from in the specified scene.
Identity_button.addEventListener(MouseEvent.CLICK, fl_ClickToGoToIdentity);
function fl_ClickToGoToIdentity(event:MouseEvent):void
MovieClip(this.root).gotoAndPlay(1, "Identitye");
}/* Click to Go to Scene and Play
Clicking on the specified symbol instance plays the movie from the specified scene and frame.
Instructions:
1. Replace "Scene 3" with the name of the scene you would like play.
2. Replace 1 with the frame number you would like the movie to play from in the specified scene.
Reviews_button.addEventListener(MouseEvent.CLICK, fl_ClickToGoToScene_13);
function fl_ClickToGoToScene_13(event:MouseEvent):void
MovieClip(this.root).gotoAndPlay(1, "Reviewse");
}/* Click to Go to Scene and Play
Clicking on the specified symbol instance plays the movie from the specified scene and frame.
Instructions:
1. Replace "Scene 3" with the name of the scene you would like play.
2. Replace 1 with the frame number you would like the movie to play from in the specified scene.
Facts_button.addEventListener(MouseEvent.CLICK, fl_ClickToGoToScene_20);
function fl_ClickToGoToScene_20(event:MouseEvent):void
MovieClip(this.root).gotoAndPlay(1, "Factse");

Unterstanding syslog messages from our wlc

Hello,
we use two wlc 4402 (4.1.181.0) and several leightweight accesspoints (AIR-AP1010-E-K9 and AIR-AP1030-E-K9 ) connected to them.
On our syslog server we get a lot of messages from the two wlc, and there are 3 message types which I am a little bit afraid of.
1. ca. 10 times per hour we get the message
apf_80211.c:4792 APF-6-NO_CONFIG_CHANGES: Not saving 'apf.cfg' - no config changes."
Cisco system message guide:
Error Message %APF-6-NO_CONFIG_CHANGES: Not saving '[chars]' - no config changes.
Explanation Not saving - no config changes.
Recommended Action No action is required.
Does anybody know why we get this messages and if it's possibly to suppress them?
2. Intermittently (several times a day) we get the following message types:
a) [ERROR] spam_l2.c 723: Max retransmissions reached on AP 00:0B:85:56:63:40 (CONFIGURE_COMMAND^M , 2)"
b) [ERROR] spam_tmr.c 569: Did not receive hearbeat reply from AP 00:0b:85:56:ae:40"
The MAC address is not every time the same but one of our accesspoints.
On our network management system we get the following trap messages with nearly exactly the same timestamp:
14.01.2008 04:21:56 CET
AP ''00.0b.85.56.63.40'', interface ''0x1'' is down.
When Airespace AP's interface operation status goes down this trap will be sent.
bsnAPDot3MacAddress = 00.0b.85.56.63.40
bsnAPIfSlotId = 0x1
14.01.2008 04:21:56 CET
AP disassociated from Switch.
When an Airespace AP disassociates from a Airespace Switch, the AP disassociated notification will be sent with the dot3 MAC address of the Airespace AP. This will notify the management system to remove Airespace AP from this Airespace Switch.
bsnAPMacAddrTrapVariable =
14.01.2008 04:22:25 CET
AP associated with Switch.
When an Airespace AP Associates to a Airespace Switch, the AP associated notification will be sent with the dot3 MAC address of the Airespace AP. This will help the management system to discover the Airespace AP and add it to system.
bsnAPMacAddrTrapVariable =
bsnAPPortNumberTrapVariable = 1
Cisco system message guide:
a) Error Message %LWAPP-3-TX_ERR3: Max retransmissions for LWAPP control message reached on AP [hex]:[hex]:[hex]:[hex]:[hex]:[hex] for [chars] (number of pending messages is [dec])
Explanation Maximum number of times an LWAPP control packet is transmitted before declaring the AP dead has been reached for this AP. The AP may not be on the network, or might have rebooted.
Recommended Action Check if the AP has rebooted or if it has been removed from the network, or if there are connectivity issues between the AP and the controller.
b) Error Message %LWAPP-3-ECHO_ERR: Did not receive heartbeat reply; AP: [hex]:[hex]:[hex]:[hex]:[hex]:[hex]
Explanation Controller did not get a response for the AP heartbeat message. There may be connectivity issues between the AP and the controller.
Recommended Action Check if the AP has rebooted or if it has been removed from the network, or if there are connectivity issues between the AP and the controller.
Because we don't see any network problems I'm wondering why the connection is lost.
Does anybody have an idea, perhaps CSCsh13928 (http://tools.cisco.com/Support/BugToolKit/search/getBugDetails.do?method=fetchBugDetails&bugId=CSCsh13928, but we don't have much traffic on the wlans) ?
Is there any possibility to remotely check if the accesspoint rebooted?
If you need further information please give me a short feedback.
Many thanks in advance,
Thorsten Steffen

Thanks for the help.
I have set up to send email and syslog messages from the RME applications. LMS server immediately started to send messages to the email server but syslog messages are not forwarded to the syslog server. Everything was done according to your instructions except that the name of the first script (syslog_forward.pl) is made consistent with what the second script (.bat) refer to (forward1.pl). What's the problem? Do RME sends the standard syslog messages via UDP port 514?
Sincerely.

Receive syslog messages from remote system

I want to replace my ancient and aging Slackware 12.0 server with an Arch server. One of the hurdles is to receive syslog messages (UDP/IP, port 514) over the network from a Cisco 678 DSL modem/router, and from a DD-WRT based wireless access point.
How do I go about getting a systemd-based Arch server to receive syslog-formatted messages from the network on UDP port 514?
I'm not looking to view the Arch system's journal over the network, but rather to receive non-local messages and log them.
Last edited by bediger4000 (2013-08-01 15:44:48)

WonderWoofy: I hope you mean "man systemd-journal-gatewayd", as I find that man page, but not "systemd-journal-gateway". systemd-journal-gatewayd works the other way. According to the man page it "serves journal events over the network. Clients must connect using HTTP."
sbmomeni: I agree that your reference says the systemd journal provides the same function - but how? And does "this functionality" refer to the logging part of syslog-ng, or to the receiving messages from other machines part?

Solaris 9 syslog messages are IP not hostname

I am trying to setup Solaris 9 to forward its syslog messages to a central server, and its working fine except the logs being sent have the IP address and not the hostname. Is there a way to change this? Thanks

no, i mean you will need to put entries for the remote hosts on your central server, or set up IN NS records in your nameserver for reverse mappings from IP -> host (not host -> IP).
Shouldn't need any switches or config changes to syslogd for it to work.
Also, check your /etc/nsswitch.conf file has at least "files dns" set for hosts.

Prime Infra 2.0 alert when syslog message received

Dear member,
May I know did prime infra 1.3, 2.0 can support alerted user when received a syslog message?
if yes, and configiuration guide for reference?
Regards

Hi Russ,
PI does not actually keep a record of the raw syslog messages it receives, and there is no report for syslogs. When PI receives a syslog, it will immediately process the message and convert it to an event/alarm.
Also, note that PI only processes severity 1 and 2 syslogs. The closest thing you can get to a syslog report
would be to run anadvanced search for events
For other alarms and events you can go to Operate > Alarms
& Events > Email Notification page. Make sure that the alarm categories that you
want to have notifications for also has the Enable checkbox checked.
Thanks-
Afroz
[Do rate the useful post]

ACE : PROBE-FAILED and Syslog messages

Hi,
When a real server is in PROBE-FAILED status, I observe a syslog message at each trial of the proble. This fills our syslog server. Is there a mean to configure the ACE in such a way that a syslog message would be generated only when a transition occurs in the probe status ?
Thank you for any hints,
Yves

Hello,
You can utilize "logging trap " command and
"logging message level " command
in order to achive what you are seeking.
The "logging trap " command limits the logging messages sent to a syslog server based on severity.
If it is set to "5 - notification", all messages that have security level of 5 or lower number are sent to the syslog server.
You can disable the display of a specific syslog
message or change the severity level of a specific system log message using
"logging message level " command.
Not sure what kind of probe you are using but If it is ICMP probe and
the reason of probe failure is arp, it generates a message for every try
as below with severity level of 3, by default.
%ACE-3-251009: ICMP health probe failed for server 192.168.0.1, connectivity error: ARP not resolved for destination ip address
%ACE-3-251009: ICMP health probe failed for server 192.168.0.1, connectivity error: ARP not resolved for destination ip address
%ACE-3-251009: ICMP health probe failed for server 192.168.0.1, connectivity error: ARP not resolved for destination ip address
%ACE-3-251009: ICMP health probe failed for server 192.168.0.1, connectivity error: ARP not resolved for destination ip address
%ACE-3-251009: ICMP health probe failed for server 192.168.0.1, connectivity error: ARP not resolved for destination ip address
%ACE-5-441002: Serverfarm (SF) is now back in service in policy_map (fs) -->
class_map (#class_default_slb). Number of failovers = 0, number of times back in service = 0
%ACE-4-442007: VIP in class: 'VIP' changed state from OUTOFSERVICE to INSERVICE
%ACE-5-441002: Serverfarm (SF) is now back in service in policy_map (fs) -->
class_map (#class_default_slb). Number of failovers = 0, number of times back in service = 0
%ACE-4-442004: Health probe ICMP detected rserver r1 (interface vlan31) changed state to UP
%ACE-4-442001: Health probe ICMP detected r1 (interface vlan31) in serverfarm SF changed state to UP
If your "logging trap " is set to "5 - notification" and you do not want
the message "%ACE-3-251009:xxx" to be sent to syslog server,
you can change its security level like below.
switch/Admin(config)# logging message 251009 level 6
switch/Admin(config)# do show logging message 251009
Message logging:
message 251009: current-level 6 default-level 3 (enabled)
You can check the message id that is filling the syslog server
and change its security level to higher number than "logging trap ".
Regards,
Kimihito.

ACE Syslog message for State change

Hi,
Is there a syslog message for a state-change for rservers, if so how could we enable this?
e.g. when probe fails state changes to 'probe-failed'
when all probes are successful state is 'operational'
Thank you
Bilal

Hi,
There is a syslog message something like below:
%ACE-3-251006: Health probe failed for server 10.80.10.10 on port 80 internal error: failed to setup a socket.
First enable logging on ACE.
ACE/Admin(config)# logging enable
http://www.cisco.com/en/US/docs/app_ntwk_services/data_center_app_services/ace_appliances/vA1_7_/configuration/system/message/guide/config.html#wp1063750
read the section: Specifying Syslog Output Locations
logging buffered 3 should generate syslog in event of probe failure.
You can also set snmp to monitor it.
cesRealServerStateChange
CISCO-ENHANCED-
SLB-MIB
State of a real server configured in a server farm changed to a new state as a result of something other than a user intervention. This notification is sent for situations such as ARP failures, probe failures, and so on.
Hope that helps.
regards,
Ajay Kumar

HT1918 I recieve an error message that my address does not match

When entering a new number for creidt card I receive an Error message that the address does not match the banks address. I'm taking it right off the bank's statement - the same address Apple has used for 5 years or more. How can I get them to allow this address?

One can divide by a number less than zero. One cannot divide by zero or a null value which is considered zero.
Unless one is dividing by a non-zero constant, one needs to test for a divisor not equal to zero. Since JavaScript is an object orientated language one needs to get the field object and then test the value property of the field.
var nDivisor = this.getField("line_2").value;
event.value = "";
if(nDivisor != 0) event.value = this.getField("line_1").value / nDivisor;

How do I get syslog messages from an AP350 sent to my Ciscoworks2000?

I am running Ciscoworks2000 and trying to get my Access Point's to send messages to the RME. I have enabled SNMP and created user's with the correct SNMP strings? Any help in getting as much information from the AP's to Ciscoworks would be greatly appreciated.

Darcy,
The setup for syslog is different to setting up SNMP. Refer to the following URL re the 'Event Notifications Setup Page'. http://www.cisco.com/univercd/cc/td/doc/product/wireless/airo_350/accsspts/ap350scg/ap350ch7.htm#1037065
In particular, please make sure that you check the 'Yes' button for 'Should Syslog Messages use the Cisco EMBLEM Format', otherwise RME will not recognise the format of the syslog messages that it receives.
As mentioned by one of the other respondants, you must also check that the AP is recognised in the RME Inventory as a Managed Device.
A list of what devices are supported in the various versions of RME can be found on CCO at http://www.cisco.com/univercd/cc/td/doc/product/rtrmgmt/cw2000/cw2000e/dev_sup/index.htm

IPv6 Duplicate Address issue

I'm having a problem involving IPv6 with stateless autoconfig on my network. I have a Cisco 800 series router and we have several VLAN interfaces each configured with an IPv6 prefix. The problem I'm noticing is that whenever any host on the network tries to start up with stateless autoconfig they immediately detect a duplicate address for whatever address they are trying to use.
I performed a packet capture and what I'm seeing is that when the host selects an IPv6 address to use, it performs the Neighbor Solicitation to check if the address is in use. I immediately see the exact same Neighbor Solicitation message echo'd back with the source MAC being the Cisco router. This causes the host to reject the address as a duplicate since it is receiving a Neigbor Soliciation for the same address it is attempting to use.
This happens on all of the VLANs I have configured for IPv6. The basic VLAN config is like this:
interface Vlan109
description Engineering VLAN
ip address .....
ip helper-address .....
ip nat inside
ip virtual-reassembly in
ip tcp adjust-mss 1300
ipv6 address HE-ENG ::/64 eui-64
ipv6 enable
ipv6 nd ra interval 60
Attached is a PCAP with some ICMPv6 traffic. You can see that the NS messages are duplicated and the source of the duplicates seems to be the Cisco router (70:ca:9b:e0:94:2e). Does anyone know what is going on here?

Hi,
Under you interface val config can you try adding:-
int vlan 109
ipv6 address autoconfig
Worth a try
Regards
Alex

%IP-4-DUPADDR: Duplicate address

Hi, I've been getting the follwoing message on my c2600 (version 13.3) router since last december (according to the log file).
005179: .Dec 28 04:35:08.652 AUS: %IP-4-DUPADDR: Duplicate address xxx.xxx.xxx.xx on
FastEthernet0/0, sourced by 0015.f987.941a
The symptom of the problem is that occassionally the network looses connactivity.
The mac addresses are both for Cisco devices. One is the router and i'm not sure what the other is possibly a firewall.
The Cisco site says that we can change the mac address of one of the offending items ?
Which would be the best one to change?
How can i find out what the other device is?
What if any issue arise with changing the mac address ?
Proably other questions that i should be asking as well, but i'll get to those later.
thanks in advance for any reponses.

changing the mac-address will not help.
You have to change the ip address.
You first have to find out what/where is the other device.
For that you can follow the L2 path.
Go the switch to which the router is connected on fast0/0. If you don't know the switch, try 'sho cdp nei'.
Once on the switch, check the mac-address with the command 'show mac-address address x.x.x'. It should give the port.
Check what device is attached to this port.
If another switch, repeat the operation above until you find the end device.
Gilles.

Syslog message on DUPLICATE ADDRESS event

Similar Messages

Maybe you are looking for