This article explains the reason for KERN_ARP_DUPLICATE_ADDR messages logs seen on subscriber device.
When static subscriber send an arp request packet with the source IP of loopback of the JSM device. Following log message is seen. Here the IPs 192.168.X.X & 192.168.Y.Y are owned by the loopback interface of JSM node. Since these IPs are owned by the loopback which is used as source interface for static subscribers. When subscriber send an ARP request packet with this source IP, Kernel detects duplicate arp address and throw these message.
Nov 20 09:54:22 JSM_RE0 kernel: KERN_ARP_DUPLICATE_ADDR: duplicate IP address 192.168.X.X! sent from address: 66:64:9b:b5:1b:7f (error count = 195295)
Nov 20 09:55:23 JSM_RE0 kernel: KERN_ARP_DUPLICATE_ADDR: duplicate IP address 192.168.Y.Y! sent from address: 66:64:9b:b5:1b:0d (error count = 195330)
In this case customer is using demux0 interface for static subscribers for which the underlying interface are AE bundles.
example-
demux0 {
unit 391450052 {
apply-groups SUB-DATA_ONLY;
vlan-tags outer 145 inner 52;
demux-options {
underlying-interface ae39;
}
family inet {
unnumbered-address lo0.100 preferred-source-address 192.168.X.Y;
To identify which subscriber is sending these ARP requests, start monitor traffic of the underlaying AEs one by one to see the ARP packets. Apply some matching filter to filter out unnecessary packets.
JSM5_RE0> monitor traffic interface ae39 layer2-headers matching "ether src 66:64:9b:b5:1b:0d and host 192.168.Y.Y" no-resolve
Nov 20 10:01:09
verbose output suppressed, use <detail> or <extensive> for full protocol decode
Address resolution is OFF.
Listening on ae39, capture size 96 bytes
10:01:09.431749 In 66:64:9b:b5:1b:0d > ff:ff:ff:ff:ff:ff, ethertype 802.1Q (0x8100), length 68: vlan 145, p 0, ethertype 802.1Q, vlan 52, p 0, ethertype ARP, arp who-has 192.168.X.X tell 192.168.X.1
10:01:11.531995 In 66:64:9b:b5:1b:0d > ff:ff:ff:ff:ff:ff, ethertype 802.1Q (0x8100), length 68: vlan 145, p 0, ethertype 802.1Q, vlan 52, p 0, ethertype ARP, arp who-has 192.168.Y.Y tell 192.168.Y.1
The above ARP packet is QinQ tagged and having S-VLAN 145 and C-VLAN 52. Let find out the the demux0 interface for this.
{master}
JSM_RE0> show subscribers physical-interface ae39 stacked-vlan-id 145 vlan-id 52
Nov 20 10:01:53
Interface IP Address/VLAN ID User Name LS:RI
demux0.391450052 [email protected] default:default
Monitor traffic of demux0.<unit> is also showing the ARP packet are sourced with the IP 192.168.X.X which is not desired. Since this IP is owned by JSM loopback interface.
JSM_RE0> monitor traffic interface demux0.391450052 no-resolve layer2-headers
Nov 20 10:02:33
Listening on demux0.391450052, capture size 96 bytes
10:02:41.653605 In 66:64:9b:b5:1b:0d > ff:ff:ff:ff:ff:ff, ethertype 802.1Q (0x8100), length 68: vlan 145, p 0, ethertype 802.1Q, vlan 52, p 0, ethertype ARP, arp who-has 192.168.Y.Z tell 192.168.X.1
10:02:42.150225 In 66:64:9b:b5:1b:0d > ff:ff:ff:ff:ff:ff, ethertype 802.1Q (0x8100), length 68: vlan 145, p 0, ethertype 802.1Q, vlan 52, p 0, ethertype ARP, arp who-has 192.168.Y.X tell 192.168.X.1
Suggest customer to check with end subscriber and fix the IP issue or shutdown the demux0.<unit> to stop these message.