Oops, I read the post as if the MACs were duplicated.
I have also come across a situtation where a faulty station (Wyse
terminal actually) responded to all ARPs as if it owned the IP. I had an
interesting conversation with Wyse support who remained convinced that
it was impossible for their terminals to do that, since they weren't
programmed that way. The fact that I had a packet capture of it
happening didn't even phase them!
I ended up tracing down the Wyse terminal via its MAC (it wasn't
changing ports as described in the original post) and replaced it.
Windows computers use ARPs to detect duplicate IPs. Perhaps something
similar is happening? It could also be a Proxy ARP issue.
Zsombor Papp wrote:
> There are duplicate IP addresses, not duplicate MACs. And all the duplicate
> IP addresses come from the same MAC address, as if a single machine had
> suddenly all the IP addresses configured on the same interface. I don't see
> how this can be attributed to a L2 loop.
>
> Firesox, what is this phantom MAC address?
>
> Thanks,
>
> Zsombor
> **Please support GroupStudy by purchasing from the GroupStudy Store:
> http://shop.groupstudy.com
> FAQ, list archives, and subscription info:
http://www.groupstudy.com/list/cisco.html
Message Posted at:
http://www.groupstudy.com/form/read.php?f=7&i=73912&t=73868
--------------------------------------------------
**Please support GroupStudy by purchasing from the GroupStudy Store:
http://shop.groupstudy.com
FAQ, list archives, and subscription info: http://www.groupstudy.com/list/cisco.html
