arpwatch 관련 질문입니다.

안녕하십니까? 홍석범입니다...

특정 장비(벤더)에서만 발생하는 현상이라면 장비벤더측에 이야기해서 펌웨어 패치등을 받으시면 될 것 같습니다.. 예전에 저희도 특정 벤더에서 동일한 현상이 있었습니다.
자세한 내용은 벤더사에 문의해 보시기 바랍니다..  

감사합니다..

희심금강 님의 글

arpwatch 를 설치 하고서

arpwatch -d 를 실행 하면

arpwatch: bogon 192.168.0.10 0:0:e2:86:2e:97
arpwatch: bogon 192.168.0.10 0:0:e2:86:2e:97
arpwatch: bogon 192.168.0.10 0:0:e2:86:2e:97
arpwatch: bogon 192.168.0.10 0:0:e2:86:2e:97
arpwatch: bogon 192.168.0.10 0:0:e2:86:2e:97
arpwatch: bogon 192.168.0.10 0:0:e2:86:2e:97
arpwatch: bogon 192.168.0.10 0:0:e2:86:2e:97
arpwatch: bogon 192.168.0.10 0:0:e2:86:2e:97

이런 메세지가 계속 출력됩니다.

사설아이피 대역은 사용하지 않고 있습니다.

arpwatch -n 192.168.0.0/24  -d 명령을 실행하면

To: root
Subject: flip flop

            hostname:
          ip address: 192.168.0.10
    ethernet address: 0:0:e2:86:2e:97
     ethernet vendor: ACER TECHNOLOGIES CORP.
old ethernet address: 0:a0:d1:e2:7a:ea
 old ethernet vendor: INVENTEC CORPORATION
           timestamp: Tuesday, December 25, 2007 11:55:36 +0900
  previous timestamp: Tuesday, December 25, 2007 11:55:36 +0900
               delta: 0 seconds
arpwatch: reused old ethernet address 192.168.0.10 0:a0:d1:e4:5b:1a (0:0:e2:86:2e:97)

From: root (Arpwatch)
To: root
Subject: flip flop

            hostname:
          ip address: 192.168.0.10
    ethernet address: 0:0:e2:86:2e:97
     ethernet vendor: ACER TECHNOLOGIES CORP.
old ethernet address: 0:a0:d1:e4:5b:1a
 old ethernet vendor: INVENTEC CORPORATION
           timestamp: Tuesday, December 25, 2007 11:55:36 +0900
  previous timestamp: Tuesday, December 25, 2007 11:55:36 +0900
               delta: 0 seconds
arpwatch: bogon 192.168.30.32 0:e:c:3e:96:ee
arpwatch: reused old ethernet address 192.168.0.10 0:a0:d1:e2:7a:f6 (0:0:e2:86:2e:97)

와 같은 메세지가 연속적으로 출력됩니다.

tcpdump로 해당 아이피를 추적해 보면

11:59:12.700639 arp reply 192.168.0.10 is-at 00:a0:d1:e2:7a:ea
11:59:12.700644 arp who-has 192.168.0.10 tell 192.168.0.10
11:59:12.701338 arp who-has 192.168.0.10 tell 192.168.0.10
11:59:12.702217 arp who-has 192.168.0.10 tell 192.168.0.10
11:59:12.706849 arp who-has 192.168.0.10 tell 192.168.0.10
11:59:12.709694 arp who-has 192.168.0.10 tell 192.168.0.10
11:59:12.712622 arp who-has 192.168.0.10 tell 192.168.0.10
11:59:12.712924 arp who-has 192.168.0.10 tell 192.168.0.10
11:59:12.713727 arp who-has 192.168.0.10 tell 192.168.0.10
11:59:12.714584 arp who-has 192.168.0.10 tell 192.168.0.10
11:59:12.714603 arp who-has 192.168.0.10 tell 192.168.0.10
11:59:12.715978 arp who-has 192.168.0.10 tell 192.168.0.10
11:59:12.716985 arp who-has 192.168.0.10 tell 192.168.0.10
11:59:12.716992 arp who-has 192.168.0.10 tell 192.168.0.10
11:59:12.717005 arp who-has 192.168.0.10 tell 192.168.0.10
11:59:12.717011 arp who-has 192.168.0.10 tell 192.168.0.10
11:59:12.718806 arp who-has 192.168.0.10 tell 192.168.0.10
11:59:12.718813 arp who-has 192.168.0.10 tell 192.168.0.10
11:59:12.719712 arp who-has 192.168.0.10 tell 192.168.0.10
11:59:12.719725 arp who-has 192.168.0.10 tell 192.168.0.10
11:59:12.724575 arp who-has 192.168.0.10 tell 192.168.0.10
11:59:12.725534 arp who-has 192.168.0.10 tell 192.168.0.10
11:59:12.728646 arp who-has 192.168.0.10 tell 192.168.0.10
11:59:12.729318 arp who-has 192.168.0.10 tell 192.168.0.10
11:59:12.730300 arp who-has 192.168.0.10 tell 192.168.0.10
11:59:12.730427 arp who-has 192.168.0.10 tell 192.168.0.10
11:59:12.732349 arp who-has 192.168.0.10 tell 192.168.0.10
11:59:12.732355 arp who-has 192.168.0.10 tell 192.168.0.10
11:59:12.733727 arp who-has 192.168.0.10 tell 192.168.0.10
11:59:12.733735 arp who-has 192.168.0.10 tell 192.168.0.10
11:59:12.733740 arp who-has 192.168.0.10 tell 192.168.0.10
11:59:12.735062 arp who-has 192.168.0.10 tell 192.168.0.10
11:59:12.735069 arp who-has 192.168.0.10 tell 192.168.0.10
11:59:12.736075 arp who-has 192.168.0.10 tell 192.168.0.10
11:59:12.736082 arp who-has 192.168.0.10 tell 192.168.0.10
11:59:12.737197 arp who-has 192.168.0.10 tell 192.168.0.10
11:59:12.737296 arp who-has 192.168.0.10 tell 192.168.0.10
11:59:12.741377 arp who-has 192.168.0.10 tell 192.168.0.10
11:59:12.743753 arp who-has 192.168.30.32 (Broadcast) tell 192.168.30.32

와 같은 메세지가 나옵니다.

서버를 여러대 운영하고 있는데 tcpdump로 보면

모두 같은 현상이 나옵니다.

문제가 있다면 대처 방법과 조언 부탁드립니다.

그럼 수고하세요.